Back to all incidents

Zoomcar

zoomcar.com
CONFIRMED

Official SEC Form 8-K Item 1.05 disclosure filed by Zoomcar regarding a material cybersecurity incident.

Observable Status CONFIRMED
Industry / Sector Technology & Commercial
Incident Classification Material Cybersecurity Incident
Attributed Threat Actor Unattributed / Unknown
Affected Population Scope Under Audit
First Seen 2025-06-13
Last Updated 2025-06-13
OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

80% CONFIDENCE
1. Primary Authority CONFIRMED BY REGULATOR Base weight: 65%
2. Evidence Specificity +15% Statutory Filing Verified
3. Corroboration Curve +0% 1 independent domain
4. Timeline & Staleness +0% 1 milestone logged
Corroborated Source Domains:
sec.gov
STATUTORY REGULATORY DISCLOSURES

Official Regulatory Filings & Legal Compliance Records

1 Verified Statutory Filing
Regulatory Ground Truth Standard: The disclosures below represent formal statutory filings and enforcement records submitted to government regulatory authorities (SEC, State Attorneys General, HHS OCR, FTC, FCC, EU/UK DPAs). In accordance with repository principles, this data is captured exactly as filed by the reporting entity and is never modified, overridden, or synthesized by AI models.
SEC

Form 8-K Item 1.05

CONFIRMED BY REGULATOR
Docket / Accession ID 0001213900-25-054319
Statutory Filing Date 2025-06-13
Disclosed Impact Scope Under Audit
Evidence Standard Regulatory Ground Truth
Statutory Filing Details & Summary (Preserved As Filed):

Item 1.05. Material Event.

On June 9, 2025, Zoomcar Holdings, Inc. (the "Company")
identified a cybersecurity incident involving unauthorized access to its information systems. The Company became aware of the incident
after certain employees received external communications from a threat actor alleging unauthorized access to Company data. Upon discovery,
the Company promptly activated its incident response plan.

Based on preliminary findings, the Company determined
that an unauthorized third party accessed a limited dataset containing certain personal information of a subset of approximately 8.4 million
users, including names, phone numbers, car registration numbers, personal addresses and email addresses associated with such users. At
this time, there is no evidence that financial information, plaintext passwords, or other sensitive identifiers were compromised.

In response to the incident, the Company has taken
immediate actions to contain the threat and enhance its security posture. These measures include implementing additional safeguards across
the cloud and internal network, increasing system monitoring, and reviewing access controls. The Company is also engaging with third-party
cybersecurity experts to further assist with the investigation. The Company has also notified the appropriate regulatory and law enforcement
authorities and is cooperating fully with their inquiries.

To date, the incident has not resulted in any
material disruption to the Company's operations. However, the Company continues to evaluate the scope and potential impacts of the
event, including legal, financial, and reputational considerations, as well as any associated remediation costs.

Forward-Looking Statements

This report contains "forward-looking statements"
within the meaning of the "safe harbor" provisions of the Private Securities Litigation Reform Act of 1995, including but
not limited to, statements regarding the Company's expectations regarding the incident disclosed and its impact on the Company.
When used in this discussion, the words "may," "believes," "intends," "seeks," "aims,"
"anticipates," "plans," "estimates," "expects," "should," "assumes,"
"continues," "could," "will," "future" and the negative of these or similar terms and
phrases are intended to identify forward-looking statements in this press release. Forward-looking statements reflect our current expectations
regarding future events, results or outcomes. These expectations may or may not be realized. Although we believe the expectations reflected
in the forward-looking statements are reasonable, we can give you no assurance these expectations will prove to be correct. Some of these
expectations may be based upon assumptions, data or judgments that prove to be incorrect. Actual events, results and outcomes may differ
materially from our expectations due to a variety of known and unknown risks, uncertainties and other factors. For a detailed discussion
of these and other risk factors, please refer to the risks detailed in our filings with the Securities and Exchange Commission, including,
without limitation, our Annual Report on Form 10-K and subsequent periodic and current reports. Past performance is not necessarily indicative
of future results. We undertake no intention or obligation to update or revise any forward-looking statements, whether as a result of
new information, future events or otherwise. Forward-looking statements should not be relied upon as representing our views as of any
date subsequent to the date of this press release.

1

View Official Regulatory Filing Document https://www.sec.gov/Archives/edgar/data/1854275/000121390025054319/0001213900-25-054319-index.htm

Technical Forensic Briefing

Incident Overview

Zoomcar, within its operating sector, has been subject to a cybersecurity incident disclosed to federal securities regulators. Ground-truth telemetry indicates the event prompted statutory disclosure under SEC cybersecurity reporting mandates.

Official SEC Form 8-K Item 1.05 disclosure filed by Zoomcar regarding a material cybersecurity incident.

Compromised Assets & Data Scope

The specific volume of affected customer, employee, or organizational records remains under active technical audit or disclosed in primary filings. Primary online perimeter and corporate domains include zoomcar.com.

Specific classes of compromised records, infrastructure, or operational systems are detailed in the official statutory filings below.

Statutory Disclosures & Compliance

  • SEC Filing: Form 8-K Item 1.05 (0001213900-25-054319) - Filing Link

Milestone Timeline (1 events logged)

2025-06-13 16:00 UTC
CONFIRMED BY REGULATOR

SEC Form 8-K Item 1.05 Disclosure

Have updated information or a new verifiable source?

This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.

Propose Update via GitHub