U.S. auto racing sanctioning firm NASCAR has confirmed being impacted by a cyberattack in March, which has compromised an undisclosed number of customers' Social Security numbers, according to The Record, a news site by cybersecurity firm Recorded Future.
"The investigation determined that the unauthorized actor acquired certain files on the Company's network between March 31 and April 3, 2025," said NASCAR. Such a disclosure comes after NASCAR was claimed to have been compromised by the Medusa ransomware group, which threatened to expose the stolen data should the company fail to pay a $4 million ransom by April 19. NASCAR remains mum about Medusa's assertions, while the leak of the pilfered data remains uncertain. Over 300 critical infrastructure organizations were reported by the FBI and other agencies to have already been targeted by Medusa since its emergence four years ago. Medusa was also noted by Comparitech Data Research Head Rebecca Moody to be among the most pervasive ransomware payloads in 2025.
"The investigation determined that the unauthorized actor acquired certain files on the Company's network between March 31 and April 3, 2025," said NASCAR. Such a disclosure comes after NASCAR was claimed to have been compromised by the Medusa ransomware group, which threatened to expose the stolen data should the company fail to pay a $4 million ransom by April 19. NASCAR remains mum about Medusa's assertions, while the leak of the pilfered data remains uncertain. Over 300 critical infrastructure organizations were reported by the FBI and other agencies to have already been targeted by Medusa since its emergence four years ago. Medusa was also noted by Comparitech Data Research Head Rebecca Moody to be among the most pervasive ransomware payloads in 2025.
