Skip to content
Ransomware Attack on Colmobil Disrupts Israel's Automotive Sector

Ransomware Attack on Colmobil Disrupts Israel's Automotive Sector

First seen 28 Oct 2026, 16:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:39 UTC
  • •Colmobil was attacked by the ransomware group SETTRA, disrupting operations significantly.
  • •The Ministry of Transport blocked Colmobil's access to vehicle-registration systems in response to the attack.
  • •SETTRA employed double extortion tactics, threatening to leak customer data unless a ransom was paid.

Colmobil, Israel's largest vehicle importer, suffered a ransomware attack attributed to the group SETTRA, which disrupted operations and led to the Ministry of Transport blocking its access to vehicle-registration systems. The attackers demanded a ransom and threatened to publish customers' personal details unless paid. Colmobil confirmed the incident and stated it was investigating, but did not disclose whether a ransom was paid. The attack raised concerns about the security of interconnected systems in the automotive industry, which rely heavily on digital processes. Customers reported delays in vehicle deliveries and services, reflecting the extensive impact of the attack on operations. The incident highlights vulnerabilities in the digital infrastructure linking vehicle importers, manufacturers, and regulatory bodies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
Colmobil cyberattack reported
Colmobil notified partners of a ransomware attack, leading to operational disruptions and government intervention.
Calcalistech
2026-10-28
SETTRA identified as threat actor
Sources revealed that the ransomware group SETTRA was behind the attack, employing double extortion tactics.
Calcalistech

More articles in this cluster (2)

Following this threat?

Track Settra and Colmobil in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

What systems were affected by the attack?
The attack primarily affected Colmobil's operations and its access to vehicle-registration systems managed by the Ministry of Transport.
Has Colmobil confirmed if they paid the ransom?
Colmobil has not confirmed whether a ransom was paid to the attackers.
What are the implications for customer data?
SETTRA threatened to publish Colmobil's customers' personal details unless the ransom was paid, raising concerns about data privacy.