Autovista Group Confirms Ransomware Attack, Sparking European Automotive Data Blackout

When ransomware hit Autovista Group in April 2026, nothing about the attack was novel — no zero-day, no exotic malware. What made it matter was where it landed. Autovista is the company behind Glass's, Eurotax and Schwacke, the reference data that dealers, insurers and fleet operators across Europe use to price a used car. When Autovista pulled systems offline to contain the attack, much of the continent briefly lost its agreed answer to a simple question: what is this vehicle worth?

That is the story defenders should take from this incident, and it's why we're revisiting it. The damage here wasn't stolen data — it was a data blackout. For a growing class of "data-as-a-service" vendors, downtime itself is the breach.

What Autovista Confirmed

Autovista, headquartered in Peterborough, UK, confirmed it was dealing with a ransomware attack that began surfacing in early April 2026, as first reported by The Register. The company disabled several customer-facing platforms to contain it, cutting off the pricing and valuation feeds its products supply to the automotive supply chain.

The knock-on effects were immediate. Dealerships couldn't produce reliable trade-in valuations or price used inventory; insurers in markets where Glass's or Eurotax are the standard couldn't settle claims on written-off vehicles; and third-party apps and APIs that ingest Autovista's data showed stale or broken figures. Autovista said it had engaged external cybersecurity specialists and, at the time of disclosure, had not identified the threat actor. "Our priority is the restoration of services while ensuring the absolute integrity of our data environments," a spokesperson told Bodyshop Magazine.

A Sector Being Picked Apart

Autovista isn't an outlier. Research from Halcyon found that 44% of automotive companies reported a ransomware attack in the past year — an industry sitting at the intersection of valuable IP, high-value transactions and a wide, often legacy, attack surface. It follows other recent hits on the sector, including the Mazda breach that exposed employee and partner data. But Mazda was data theft; Autovista is something continuity plans account for less often — the weaponization of downtime.

The Real Lesson: Concentration Is the Exposure

Strip away the specifics and Autovista rhymes with a pattern we keep seeing. When one provider becomes the single source of truth for an entire market, a routine ransomware attack becomes a systemic event. It's the same dynamic that turns a breach at a records platform like CareCloud into a 350,000-person incident: the concentration is the exposure. No patch closes it, because the risk isn't a flaw in the vendor — it's how much of the market depends on that vendor staying up.

Most third-party risk programs are built around a data-theft question: what happens if our vendor is breached and our data leaks? Autovista poses the one many continuity plans skip — what happens if our vendor simply goes dark for a week? For a valuation feed, an EHR, a payments rail, or any data-as-a-service dependency, availability is the security property that fails first.

What Defenders Should Actually Do

The action items are unglamorous and specific:

• Inventory your single-source data dependencies. List the external feeds your operations can't run without — valuation, pricing, identity, mapping, payments — and flag the ones with no alternative.
• Keep a fallback. Where a feed is business-critical, maintain a secondary provider or an offline "emergency" cache good enough to keep transactions moving for a few days.
• Get the numbers in writing before you need them. Ask each critical vendor for its recovery-time objective and breach-notification SLA; treat a vague answer as a risk finding.
• Put data-as-a-service vendors in your BCP/DR plan, not just your data-protection policy. Model a multi-day outage of each one and rehearse the manual fallback.

What's Still Open

As of Autovista's April disclosure, several things were unresolved, and we're not filling them in: the threat actor was unnamed, there was no confirmation of whether data was exfiltrated as well as encrypted, and the restoration timeline — along with any resulting "valuation backlog" — was still unfolding.

Further Reading and Primary Sources

• The Register — Automotive data biz Autovista hit by ransomware (first report)
• Bodyshop Magazine — Autovista confirms ransomware attack (company statement)
• Halcyon — 44% of automotive firms hit by ransomware (sector research)