Irwin Automotive Group Data Breach: Aoqin Ransomware Claim (Nov 2026)
Summary
In the latest cybersecurity news, Irwin Automotive Group — an organization based in US — has fallen victim to a ransomware attack conducted by the group Aoqin. This data breach, discovered on 2026-11-09T22:51:05.015280+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | Irwin Automotive Group |
| Threat Group | Aoqin |
| Summary | Irwin Automotive Group is a premier car dealership located in Laconia, NH, specializing in new and pre-owned vehicles from trusted manufacturers such as Toyota, Chevrolet, Hyundai, Ford, and Lincoln. They offer a wide range of services including automotive sales, financing options, and expert maintenance performed by factory-trained technicians. The dealership is committed to providing a transparent and enjoyable car shopping experience, with a focus on customer satisfaction and community involvement. Irwin Automotive Group serves clients across the Lakes Region and Central New Hampshire, ensuring a reliable and quality service for all automotive needs. Status: Not paid. Data publication: 2026-11-18 22:00 UTC. Revenue: $27M. Employees: 200. Data type: Contracts, banking, clientsData, confidential. |
| Date of Breach | 2026-11-09T22:50:50.050605+00:00 |
| Discovery Date | 2026-11-09T22:51:05.015280+00:00 |
| Region | US |
| Business Sector | Retail & E-Commerce |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- real-time breach alerts — close the gap attackers exploit.
- phishing simulations — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
