NASCAR announces data breach after cyberattack exposes sensitive information

NASCAR data breach overview:

• Who: NASCAR is notifying an unknown number of individuals affected by a data breach.
• Why: The breach exposed personal information, including Social Security numbers.
• Where: NASCAR is based in the United States.
• How to Get Help: Did you receive a letter notifying you that your information was compromised in the NASCAR data breach? See if you’re eligible to pursue compensation.

NASCAR has alerted an unspecified number of individuals that their personal information was compromised following a cyberattack in March. The NASCAR data breach reportedly exposed sensitive data, including Social Security numbers.

NASCAR’s IT team discovered the unauthorized access to its network on April 3. The company promptly initiated an investigation, enlisting the help of a cybersecurity firm and notifying law enforcement.

According to NASCAR, the unauthorized access occurred between March 31 and April 3, 2025, during which hackers exfiltrated files containing personal information. 

“The investigation determined that the unauthorized actor acquired certain files on the Company’s network,” NASCAR said.

In late June, NASCAR confirmed that Social Security numbers were among the compromised data. Data breach notification letters were sent to consumers on July 24, offering them one year of credit monitoring services. 

Medusa ransomware group claims responsibility Nascar cyberattack

According to media reports, ransomware group Medusa claimed responsibility for the attack, demanding a $4 million ransom.

The ransomware group, notorious for targeting critical infrastructure, claims it stole approximately 1 terabyte of data from NASCAR. They set an April 19 deadline for ransom payment, though it remains unclear if the data was published. 

Medusa has been linked to over 300 cyberattacks, including a significant breach of Minneapolis Public Schools affecting over 100,000 individuals.

NASCAR is a prominent auto racing sanctioning body based in Daytona Beach, Florida. It organizes more than 1,500 races annually across the United States and owns 14 major racing venues. Despite the severity of the NASCAR data breach, NASCAR has not confirmed Medusa’s claims or provided specific details about the number of individuals affected.

In response to the breach, NASCAR has offered affected individuals one or two years of free credit and identity monitoring services. The company has also begun sending written notifications to inform them of the incident.

For more information about the NASCAR data breach, individuals can contact NASCAR through the contact details provided in the notification letters or visit their official website for updates.

NASCAR says it has not received any reports of identity theft or fraud related to the cyberattack so far. The company is not currently facing legal action over the incident, but Top Class Actions follows data breaches closely as they sometimes lead to class action lawsuits.

Currently, car rental company Hertz is facing a class action lawsuit as a result of a cyberattack in late 2024 by the ransomware group CLOP.

Were you affected by this NASCAR cyberattack? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• Remington recalls hair dryers sold online via Amazon, Walmart and Target
• Another Suzuki class action claims motorcycles have brake defect
• Class action claims Tesla website trackers collect user data without consent
• Langers class action alleges 100% juice claims are misleading