Škoda online-shop breach

Škoda Auto Deutschland accessories-shop breach: attackers exploited the shop software, customer data and password hashes were accessible, logs cannot show what was copied

Škoda Auto Deutschland's security monitoring found that unauthorised parties had exploited a vulnerability in the standard shop software of its online accessories shop and gained temporary access to the shop system; the shop was taken offline, the vulnerability fixed, an external IT forensics firm engaged and the incident reported to the competent data-protection authority (Škoda Auto Deutschland). The shop stores names and addresses, email addresses and sometimes telephone numbers, order information and customer-account credentials made up of the email address and a password kept as a cryptographic hash; full credit card data is processed only by the payment providers (Škoda Auto Deutschland). Škoda's analysis found that access to the stored data was possible in principle, but the nature of its logs does not allow it to reconstruct whether and to what extent data was actually copied or retrieved, and it has no concrete indication of misuse (Škoda Auto Deutschland). Only the accessories shop run by Škoda Auto Deutschland GmbH for customers in Germany was affected, not other Škoda online shops, the systems of the manufacturer Škoda Auto a.s. or the Škoda Connect portal (Škoda Auto Deutschland). SecurityWeek reported the disclosure on 2026-05-11 and noted that the number of affected customers had not been disclosed (SecurityWeek, 2026-05-11).