Stellantis Breach via Third-Party Provider
Corrected October 4, 2026. An earlier version of this article included material about a separate incident and unsupported details about the provider and attack method. This version replaces that material with facts from Stellantis’ September 21, 2025 announcement.
What Stellantis confirmed
On September 21, 2025, Stellantis announced unauthorized access to a third-party platform used for its North American customer service operations. The company said it had activated its incident response process, begun investigating, and taken steps to contain the incident. It was also notifying authorities and affected customers.
According to Stellantis, the information involved was limited to customer contact information. The company said the platform did not store financial or sensitive personal information and that none of that information was accessed.
The September 21 statement did not identify the service provider, the number of affected customers, or the attack method. It did warn customers to watch for phishing messages and verify unexpected communications through official channels. Read Stellantis’ original announcement.
Why this matters for North Carolina contractors
A contractor’s technology extends beyond the office network. For example, project documents, customer contact details, and employee access may depend on software vendors and outside service providers. The practical lesson is to understand those dependencies and decide who is responsible when something goes wrong.
The following questions are Computerbilities’ recommendations for reviewing vendor risk. They are not findings about the cause of the Stellantis incident.
Five questions to ask your service providers
- What information and access do you hold? Keep an inventory of vendors, the data they handle, their system access, and the person at your company responsible for each relationship.
- How is access protected? Require multifactor authentication where supported, restrict permissions to the work being performed, and remove access when it is no longer needed. For sensitive accounts, ask about phishing-resistant options such as security keys.
- What security commitments can we verify? Agree on how information is protected, retained, and deleted. Ask for evidence that the provider follows those commitments, rather than relying on a sales promise.
- Who contacts us after an incident? Document notification expectations, your internal contact, the provider’s escalation route, and responsibilities for investigating and responding.
- How will work continue if the service is unavailable? Identify essential tasks, document recovery arrangements, and test the plan with the people and providers involved.
These questions draw on the FTC’s cybersecurity guidance for small businesses and NIST’s guidance on multifactor authentication. The right controls depend on the information a vendor holds and the access it needs.
Turn the questions into a practical review
Start with one service your business relies on, such as project management software, email, or remote IT support. Write down the answers, identify missing information, and assign an owner and a date to resolve each gap. Repeat the review when a provider’s role or access changes.
For construction businesses, connect that review to everyday work: who can open project files, who can change an account, and who your office or field team calls when access fails. Learn more about Computerbilities’ IT support for construction companies.
Need help reviewing your IT risks? Contact Computerbilities to discuss your systems, service providers, and priorities.