In a nutshell: Bosch is being extorted by ransomware group D1R with threats to publish design documentation and CAN protocol materials allegedly stolen via a Synopsys vulnerability.
Ransomware group D1R has listed Bosch on their darknet leak site and threatens to publish design documentation within eleven days. The data is said to have been stolen during a breach at Synopsys, a third-party provider to Bosch.
Ransomware group D1R has listed industrial conglomerate Bosch on their leak site in the darknet with an eleven-day deadline. According to the attackers, the data was not obtained through a direct attack on Bosch, but rather through a vulnerability at American company Synopsys, whose design automation software is deployed worldwide. The hacker group claims to have exploited faulty logic in Synopsys’ registration form to retrieve a database containing 40,000 corporate customers.
Among the data samples published by D1R are confidential design documents, including excerpts from the manual for Controller Area Network (CAN) – a communications protocol that Bosch developed in 1983 and which is now used worldwide to network electronic components in vehicles, trains and aircraft. The directory tree of the stolen data also shows numerous files with the .vhd extension, which typically contain hardware description language source code (VHDL) for describing integrated electronic circuits. The exact scope of the leak has not yet been confirmed by Bosch.
The exposure of these design files poses significant risks: proprietary hardware designs could be revealed, which both competitors and cybercriminals could use to identify vulnerabilities directly in the hardware architecture. In addition to Bosch, Synopsys itself is also being extorted by D1R with the same eleven-day deadline. Bosch was already targeted by data breaches via compromised third parties in 2021 and 2025, indicating a systemic risk in the supply chain.
Source: www.it-daily.net · Published 13 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.