Lucid Group has confirmed that one of its vendors suffered a cybersecurity incident, and the emerging ransomware crew tracked as SovCali (also written Sovcali) is now threatening to publish an additional 100 GB of allegedly stolen Lucid engineering material within two days of an August 28, 2026 post to its Tor leak site. The group's original listing, indexed by ransomware.live on August 9 with an estimated attack date of August 4, claims possession of a 5.078 TB engineering archive attributed to Lucid Motors and a partner named in the listing as eShocan. BreachNews describes the same claim as "approximately 5 TB," so the volume figure should be read as a range of roughly 5 TB (BreachNews) to a precise 5.078 TB (SovCali's own leak-site text as republished by ransomware.live and hendryadrian.com). Lucid has not confirmed the volume, has not attributed the incident to SovCali publicly, and says its review to date found no vendor access to customer data.
A sourcing note up front: none of the material available for this brief carries regulator, national CERT, or established security press weight. The strongest source is Lucid's own corporate statement as carried by MarketScreener. Everything about scale, file types, and actor tradecraft comes from leak-site scraping, OSINT aggregators, and vendor blog posts, and is attributed accordingly below.
What Happened
The timeline assembled across the sources runs as follows.
Ransomware.live records an estimated attack date of August 4, 2026, with the Lucidmotors entry discovered on the SovCali leak portal at 09:21 UTC on August 9. The same discovery timestamp appears in the hendryadrian.com monitoring entry, which cites the onion address z3mojpjnxt5tgqvu4wgosihl7pxvrcbyjcgquw2bwkyye5gwbhnf4kqd.onion and tags the victim as US, Transportation sector. Ransomware.live flags SovCali as a "New Group" and attaches an explicit caveat that claims from emerging groups should be treated with caution until independently verified.
On or around August 22, Lucid issued a public statement. In it the company says it "has been made aware that one of our vendors suffered a cybersecurity incident" and is working with that vendor to contain and investigate. The statement adds that the review to date confirms the vendor had no access to customer data nor to information that could be used to interfere with vehicle operation or core business, and that retail and production activities are unaffected. Lucid says it is working with investigators and law enforcement to identify those responsible, protect its intellectual property, and pursue civil and criminal remedies.
On August 28, per BreachNews, SovCali posted a new message claiming Lucid had been given sufficient time to respond and had failed to act appropriately. The group said it would issue another update within two days and publish a further 100 GB of data. It did not specify the contents of that threatened release.
Accounts genuinely diverge on scope. SovCali describes a "complete engineering archive" of Lucid itself. Lucid describes a vendor incident with no reach into customer data or vehicle systems and says core operations are untouched. Both statements can be simultaneously true only if a third party held a very large volume of Lucid engineering material, which is consistent with the leak-site listing naming a second organization alongside Lucid. Neither Lucid nor any independent investigator has published a reconciliation of the two accounts, and no source reviewed here identifies the vendor by name with confirmation.
What Was Taken
The claimed inventory comes from SovCali's own leak-site description, reproduced consistently across ransomware.live, hendryadrian.com, and a LinkedIn post by researcher Hendry Rahardja. It lists CATIA and STEP CAD models, FEA and NVH analyses, multi-gigabyte CFD simulations of a LiDAR washing system, topology optimization studies, static and modal results for the Gravity and Midsize enclosures, bills of materials, and internal progress reports.
Two figures matter and they measure different things:
The claimed total holding. 5.078 TB per SovCali's listing, rendered as "approximately 5 TB" by BreachNews. Unverified by Lucid.
The claimed proof release. Approximately 35 GB, already published per both BreachNews and DigIntLab. DigIntLab, an OSINT outfit in Milan, characterises this tranche as primarily FEA/CAE files with .fem, .h3d, .out and .spcf extensions plus .pptx and .xlsx summary reports, covering stiffness, strain energy, displacement and NVH assessments for an IC display housing and Pull/Outboard Switch simulations. DigIntLab also states the target operates a major facility in Saudi Arabia known as AMP-2. That level of file-level detail appears in only one source and should be treated as a single-source claim rather than established fact.
The threatened release. A further 100 GB, contents unspecified, per SovCali's August 28 post as reported by BreachNews.
The consistent thread is that this is an intellectual property extortion play, not a personal data breach. No source reviewed here claims exposure of customer records, and Lucid's statement specifically denies vendor access to customer data. A HackNotice entry dated August 11 exists for "Lucid Motors & eShocan Engineering" but contains only the service's standard boilerplate and adds no independent findings.
Why It Matters
Stolen CAE and simulation data is a different class of loss from a customer database, and defenders in manufacturing should think about it differently.
FEA, NVH, CFD and topology optimization outputs encode the results of expensive physical and computational testing programmes. As DigIntLab notes in its assessment, exposure of these artifacts can enable reverse engineering of safety-critical components, compromise supply-chain confidentiality, and cascade risk outward to suppliers and manufacturing partners whose own designs appear in the same models. Unlike PII, there is no notification-and-monitoring remedy. Once a competitor or a state-aligned buyer has a validated crash or stiffness model, the loss is permanent.
SovCali has reportedly leaned on exactly that leverage. BreachNews reports the group sought direct negotiation with Lucid and threatened to make the material available to competitors if no agreement was reached, which reframes the extortion from "pay to prevent publication" to "pay to prevent transfer."
The second lesson is structural. Lucid's own account is that the compromise sat at a vendor, not inside Lucid. Automotive engineering programmes routinely distribute CAD and simulation packages to simulation bureaus, tier-one suppliers, test houses and contract engineering firms. Each of those parties inherits a copy of the crown jewels and rarely inherits the OEM's security budget. Lucid's containment posture, that customer data and vehicle operation were never in scope, is a reasonable outcome for a vendor incident, and it is also the outcome that limits regulatory exposure without limiting competitive damage.
Third, SovCali is new. Brinztech dates first identification to August 2026 and describes continued expansion into new verticals, most recently adding a technology-sector victim after an earlier focus on transportation and engineering. Emerging groups have shorter track records on honouring negotiated deletions and are more prone to inflating claims for credibility, which is precisely why ransomware.live attaches a caution banner to the listing.
The Attack Technique
No source reviewed here establishes the intrusion vector for this specific incident. Lucid's statement does not describe how the vendor was compromised, and the leak-site postings do not either.
Brinztech, a commercial security vendor, publishes a general TTP profile for SovCali: initial access frequently obtained by purchasing infostealer logs or leveraging previously compromised corporate credentials and phishing vectors; custom binaries using layered AES-256 and RSA encryption; and mass exfiltration of multi-terabyte data sets staged before any encryption is triggered, with the leak site used as the primary coercion mechanism. That profile is a single vendor's characterisation of the group in general, not a finding about the Lucid vendor intrusion, and it should be read as such.
One adjacent data point is worth noting with care. The ransomware.live victim page displays Hudson Rock infostealer telemetry associated with the victim domain, listing 1 compromised employee, 226 compromised users, 19 third-party employee credentials, and an external attack surface figure of 30. This is background exposure telemetry for the domain. It is not evidence that any of those credentials were used in this intrusion, and no source makes that link. It is, however, consistent with the general access pattern Brinztech attributes to the group, and it is the kind of exposure worth auditing if you are a supplier in this ecosystem.
The volume claimed, north of 5 TB, implies either sustained exfiltration over an extended dwell period or access to a bulk repository such as a PLM archive, engineering file share, or simulation cluster storage. That is inference from the claimed data set, not a sourced finding.
What Organizations Should Do
Inventory who holds your CAE and PLM data outside your perimeter. Simulation bureaus, test houses, contract engineering firms and tier-one suppliers accumulate full-fidelity copies of design data. Build the list before you need it, and know which programmes and which enclosures each party holds.
Put egress volume monitoring on engineering file stores. Multi-terabyte staging and exfiltration from a PLM archive or simulation cluster is one of the few ransomware behaviours that is loud in network telemetry. Alert on anomalous bulk reads and outbound transfers from CAD/CAE repositories specifically, not just on generic DLP triggers.
Audit infostealer exposure across your vendor base, not just your own staff. Credentials belonging to contractor and supplier employees frequently sit outside corporate MFA enforcement. Where a vendor's staff access your engineering systems, require phishing-resistant MFA on those accounts and check them against stealer-log feeds on a recurring basis.
Contractually bind vendors to breach notification timelines and data minimisation. Suppliers should hold the minimum subset of models needed for the engagement, with defined retention and verified deletion at project close. A vendor should not still be holding a full programme archive years after delivery.
Segment engineering data by programme. Compartmentalising by vehicle line and by enclosure limits how much a single compromised vendor account can reach. A breach that yields one programme's NVH results is materially less damaging than one that yields a complete archive.
Pre-plan for IP extortion specifically. Standard incident response playbooks are built around notification obligations for personal data. IP theft has none of those triggers and all of the competitive damage. Decide in advance who owns the negotiation decision, what your trade secret litigation posture is, and how you would assess whether published files are authentic. Lucid's public stance, working with law enforcement while pursuing civil and criminal remedies, is the template for the latter.
Track this listing. SovCali stated it would post again within two days of August 28. If a 100 GB release lands, the content will indicate whether the group actually holds the full claimed archive or has been padding a smaller haul.
Sources: SovCali Threatens 100GB Lucid Motors Data Leak | Ransomware.live - Victim: Lucidmotors | Lucid Motors & eShocan Engineering – HackNotice | DigIntLab's Post | Emerging Sovcali Ransomware Syndicate Adds Technology Sector Victim... | Lucidmotors reportedly hit by Sovcali in a ransom claim involving 5... | Lucid : Motors Statement Regarding Vendor Cybersecurity Incident | Ransom! Lucidmotors (AUG-2026)