Ransomware Group thegentlemen Hits: Auto Holler
Summary
In the latest cybersecurity news, Auto Holler — an organization based in AT — has fallen victim to a ransomware attack conducted by the group thegentlemen. This data breach, discovered on 2026-09-30T03:35:51.816849+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | Auto Holler |
| Threat Group | thegentlemen |
| Summary | autohoeller.at zoominfo.com/c/auto-höller/431018598 Auto Höller (family business founded 1968 by Erwin and Monika Höller as a small filling station in Seekirchen) is a multi-brand car dealership and workshop in Eugendorf near Salzburg, Austria, employing 32 staff across two locations. It is an official long-standing dealer for Kia (top-5 Kia partner in Austria), Mazda (one of the largest in western Austria) and Isuzu commercial vehicles, selling new, young (“HÖLLISCH GUT” certified) and used cars plus fleet management, financing and a full-service workshop with body shop and §57a inspection station. Since 2006 it has been led by the founder’s son Markus Höller (sole owner across three legal entities: GmbH, GmbH & Co KG and an Immobilien company), with total assets of €5.7M as of end-2024. The dealership is locally famous for its humor-driven marketing (“Höllisch gut” branding, cabaret evenings) |
| Date of Breach | 2026-09-29T16:08:49+00:00 |
| Discovery Date | 2026-09-30T03:35:51.816849+00:00 |
| Region | AT |
| Target Domain | autohoeller.at |
| Business Sector | Retail & E-Commerce |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- real-time breach alerts — close the gap attackers exploit.
- phishing simulations — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
