The Pandora ransomware affiliate has compromised one of the largest automotive car-component suppliers working alongside Toyota, Ford, and Mercedes-Benz. Pandora threat actors have recently emerged in the wild and are quickly growing a reputation of double-extortion; the theft of information from a victim, then continuing to hold that information hostage for more money, even though the victims paid the original ransom demand. The compromised manufacturer, Denso, stated on Monday that a cyber-attack was unleashed on the company over the weekend, resulting in exfiltration of classified information. IT teams noticed the attack unfolding and “promptly cut off the network connection of devices that received unauthorized access and confirmed that there is no impact on other Denso facilities.” Shortly after, Pandora threat actors began leaking the exfiltrated data on dark web marketplaces and forums. So far, this is the second major supply-chain attack incident involving Toyota suppliers this year; with the first being the cyber-attack on Kojima Industries Corporation which also manufactures vehicle components. CTIX continues to monitor threat actors worldwide and will provide additional updates as needed.