Ransomware Gang Claims Bosch and Synopsys Hacks. Synopsys Says It Sees Nothing.
A criminal group called D1R says it stole sensitive data from two major companies and will publish it unless it gets paid. One of those companies is pushing back.
Key points
- A criminal group called D1R claimed in 2025 to have stolen data from Bosch, the German industrial giant, and Synopsys, a US semiconductor software company.
- D1R is threatening to publish the stolen data publicly unless both companies pay a ransom.
- Synopsys says its investigation has found no evidence that any of its data was taken.
- Bosch has not publicly confirmed or denied the breach claim at the time of writing.
- Customers and partners of both companies should watch for suspicious contact that uses their personal or business details.
A criminal group calling itself D1R surfaced with a blunt threat: pay up, or we leak your data. It claims to have broken into systems at Bosch, the German engineering company most people know from power tools and car parts, and Synopsys, an American firm whose software helps engineers design the chips inside phones, cars and computers.
D1R is running what security researchers call a data-extortion scheme: steal files, then threaten to release them unless payment arrives. No encryption, no locked systems. The pressure comes from regulatory exposure and reputational damage.
This model is worth keeping in mind when reading ransom claims. We covered how Kairos ran a near-identical playbook on a US government agency on 4 July 2026, and that case ended with a seven-figure payout based on a threat alone.
Should customers be worried?
For ordinary people the immediate risk is indirect. If personal or business data tied to Bosch or Synopsys was stored in affected systems, that information could surface in criminal marketplaces.
Synopsys says clearly it found no evidence a breach happened on its side. That matters: companies have every incentive to investigate fast when a group posts claims publicly, because regulators start asking questions within hours. A clean internal audit isn't nothing.
Bosch hasn't made a comparable statement. That silence is worth watching.
The failure mode here is familiar. A criminal group posts a claim, one target goes quiet, the other issues a careful denial that's technically accurate but leaves wiggle room. SecurityWeek reported the initial claims, and the story is still developing.
D1R's playbook doesn't require a full network intrusion. Sometimes groups like this pull data from a third-party supplier, a misconfigured cloud storage bucket (an online file store left open by accident) or a software-as-a-service account sitting on the edge of a corporate network. The source matters enormously, and neither company has confirmed it yet.
If a real breach happened, the post-mortem will likely say access controls on external-facing storage weren't tight enough. That's the same finding we keep seeing across sectors.
What to do now
If you have any business relationship with either company, watch for contact that already knows something specific about you: your account details, your order history, your registered address. That kind of targeted outreach, using real data to seem credible, is the practical downstream risk here.
Ignore the generic warnings. The dangerous email is the one that already knows your name.
