NASCAR Data Breach Investigation
The data breach lawyers at The Lyon Firm are investigating a reported ransomware attack at NASCAR, potentially impacting employee data. Contact our legal team to learn more about your next steps following a data theft incident and to discuss taking legal action. Compensation and justice can be sought in data privacy cases and The Lyon Firm has settled numerous data breach lawsuits on behalf of plaintiffs in all fifty states. Call for a free consultation.
What happened at NASCAR?
The National Association for Stock Car Auto Racing (NASCAR), a behemoth in American motorsports, has confirmed that they were targeted in a data breach linked to the Medusa ransomware group. The breach, claimed by Medusa as early as April 2025, was only recently disclosed by NASCAR on July 27, 2025.
The alleged cyberattack, detected between March 31 and April 3, 2025, included an unauthorized intrusion into a third-party system or NASCAR’s network, with Medusa claiming responsibility. The ransomware group alleged it exfiltrated over 1 terabyte of data, demanding a $4 million ransom to prevent the release of the stolen files.
Initial reports suggested the stolen data included employee names, email addresses, job titles, raceway maps, internal notes, and possibly Social Security numbers—details recently confirmed by the official NASCAR state AG filings. The attack went undetected until June 24, 2025, when an investigation revealed the extent of the compromise, prompting data breach notification letters to be sent to affected individuals on July 24, 2025.
Medusa, a Ransomware-as-a-Service (RaaS) operation active since 2021, has targeted over 300 organizations across various industries. The group’s tactic of double extortion—encrypting data and threatening leaks—aligned with its demand, supported by leaked document samples on its dark web site.
NASCAR’s nearly three-month delay in public acknowledgment of the incident have fueled speculation and concern. The exposure of such a large data set poses significant privacy risks for NASCAR employees, partners, and potentially fans. Social Security numbers, a key piece of stolen information, open the door to identity theft, where criminals could open fraudulent accounts or file false tax returns.
The breach potentially impacts thousands and amplifies privacy concerns, yet the exact number of victims remains unclear. Legal action could be a viable option for victims, and victims should consult a lawyer to clarify rights, especially given the breach’s scale. We have filed numerous class action data breach lawsuits on behalf of clients nationwide. Call now for a free consultation and case review.