Short answer
Colmobil, which imports Mercedes-Benz, Hyundai, Mitsubishi, ORA and Jaecoo cars in Israel, said on 14 October 2026 that it had detected a security incident. Calcalist later reported, citing unnamed sources, that the ransomware group SETTRA was behind it and had threatened to publish customers' personal details. Colmobil has not confirmed that. It says it has returned to full operation and that no information has been exposed publicly.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Colmobil |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Automotive |
| Country | Israel |
| Detected | 2026-10-14 |
| Disclosed | 2026-10-14 |
| People or records affected | Not stated. Colmobil said no information was exposed publicly. It delivered 62,657 new vehicles in January to September 2026. |
What data was exposed
- Customer personal details (threatened with publication, according to Calcalist's sources)
- Scope of any stolen data not confirmed by the company
What happened
On 14 October 2026 Colmobil told business partners and customers its technology team had detected an information security incident “a few hours” earlier. CTech reported that service centres stayed open but took cars on a limited basis. Colmobil is Israel’s biggest importer, with 24.5 percent of the new car market and 62,657 vehicles delivered in the first nine months of the year, according to figures from the Israel Vehicle Importers Association.
Who was behind it
Two weeks later, on 28 October, Calcalist reported that the ransomware group SETTRA was responsible. The group steals data, encrypts files and threatens to publish what it took. Sources told the paper SETTRA threatened to release customers’ personal details unless Colmobil paid. Colmobil has not confirmed the attribution, and it declined to say whether it paid.
Impact on customers
A Hebrew-language Calcalist piece from 25 October says deliveries slipped, including to leasing companies, and Mercedes customers reported service delays. The Ministry of Transport cut Colmobil’s access to the system importers use to register new cars. The National Cyber Directorate told the paper it could not discuss details of the case.
What Colmobil has said
The company said it had returned to full operation and that “No information has been exposed to the public.” It also said the attack had nothing to do with vehicle systems or manufacturers, and that its cars do not receive over-the-air updates.
What is still unknown
- What data was actually copied, and how many customers it covers.
- How the attackers got in. Naming the ransomware family does not answer that.
- Whether a ransom was paid. Only unnamed sources say so.
The safest assumption for Colmobil customers is that contact and vehicle details could be used to make scam calls sound real. Read our guides on phishing messages and urgent payment scams, and follow the data breach checklist. Other recent cases are listed on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or WhatsApp messages from someone posing as Colmobil, a dealership or a Mercedes or Hyundai service centre, citing your real car or appointment to ask for payment or card details
- Fake texts about a delayed delivery, a service booking or a 'recall' that link to a copied payment page
- Extortion messages that claim to hold your details. SETTRA is reported to threaten publication, so a demand to you personally would be a scam or a follow-on attempt
- Fake Ministry of Transport or vehicle licence fee messages that exploit the registration disruption
What to do if you are affected
- 01Contact Colmobil or your dealer using the phone number on the official website, not a number in a message, to confirm any booking, delivery date or payment request.
- 02Do not pay anything because of a message or call that mentions the attack. Ask for the request in writing and verify it with the company.
- 03Change the password on any Colmobil, dealership or leasing account, and anywhere you reused it.
- 04Check your bank and card statements for unfamiliar charges and ask the bank to replace the card if you see any.
- 05Report suspicious messages to the Israel National Cyber Directorate hotline (119) and, for fraud, to the Israel Police.
Frequently asked questions
Was my personal data stolen in the Colmobil attack?
Colmobil has not said. It stated that no information was exposed publicly. Calcalist's sources say the attackers threatened to publish customers' personal details, but the company has not confirmed what, if anything, was taken.
Did Colmobil pay the ransom?
Calcalist cites unnamed sources who say it did. Colmobil declined to comment on the nature of the attack or on any payment.
Can my car be hacked because of this?
Colmobil said the incident was unrelated to vehicle systems or manufacturers and that its cars have no over-the-air updates. Calcalist reported nothing showing cars on the road were affected.
Why did the Transport Ministry cut Colmobil off?
According to Calcalist, the ministry disconnected Colmobil from the system importers use to register new vehicles, as a containment step. That is why some deliveries were delayed.
Who is SETTRA?
A ransomware group that steals data, encrypts files and threatens to publish what it took, according to Calcalist. The attribution rests on the newspaper's sources, not on a statement from Colmobil.
Sources
- Colmobil hit by cyberattack (CTech report, 14 October 2026), Calcalist CTech, 2026-10-14
- Ransomware group SETTRA behind the Colmobil attack (CTech report, 28 October 2026), Calcalist CTech, 2026-10-28
- מתקפת סייבר על כלמוביל: האם המכונית הבאה שלכם בסכנת פריצה? (Cyberattack on Colmobil: is your next car at risk of being hacked?), Calcalist, 2026-10-25
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.