Volkswagen Group is currently investigating claims from the 8Base ransomware group, which asserts it has stolen sensitive company data. While Volkswagen has stated that its core IT systems remain secure, concerns linger about potential breaches through third-party suppliers. The 8Base group, known for its double-extortion tactics, threatened to leak confidential information, including employee files and financial records. Although no public data dump has occurred yet, the incident underscores the growing trend of cyberattacks targeting large corporations via their supply chains, highlighting the critical need for robust third-party risk management to prevent similar threats in the future. This situation may also lead to regulatory scrutiny under the EU’s General Data Protection Regulation, should the breach be substantiated.