Israel’s largest vehicle importer has a name for its attacker. Cybersecurity sources told Calcalist this week that SETTRA, a ransomware crew that lists victims on its own extortion site, ran the October 14 intrusion at Colmobil. The group demanded payment and threatened to publish customers’ personal details if it did not arrive, according to people familiar with the case. Hebrew-language outlets covering the same incident say Colmobil paid, though the sum has not surfaced.
The ministry pulled the plug
The damage was administrative before it was digital. Israel’s Ministry of Transport cut Colmobil off from the state registration platform, which froze new-vehicle paperwork for brands the importer handles, Mercedes-Benz among them. Leasing customers reported delivery dates slipping while the link stayed severed. Calcalist called it the first incident of its kind involving an Israeli importer.
Why a car importer is a juicy target
Importers do not just sell cars. They run the connective tissue between factory order books, customs clearance, registration clerks and payment processors, moving billions of shekels a year. Colmobil’s own statement, quoted by Calcalist, said its technology team detected the event within hours, notified regulators and kept the business running.
The cyber and physical edge is blurring
What makes this more than a corporate breach is where import logs sit. Importer systems exchange vehicle identifiers, trim data and telematics provisioning details with manufacturers, which is the same channel a connected car’s identity is built on. Analysts quoted in the Calcalist piece argue that a stolen importer credential is a step toward vehicle-level access, not just a billing nuisance.
SETTRA is young and moving fast
Threat-intelligence trackers count only a handful of confirmed victims for SETTRA across two countries, which makes a national importer an outsized trophy. Colmobil has not confirmed the attacker or any payment.
