D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion

The D1R extortion group claimed it breached Synopsys and used information from that access to target customers including Bosch and Arm. Posts attributed to the group alleged theft of a Synopsys corporate client database containing roughly 40,000 entries, access to Bosch engineering-related material including a claimed CAN module implementation, and the download of Arm’s Athena Download Manager. The attackers also asserted that leaked Synopsys data and third-party access paths helped them identify and pursue additional victims, while saying Arm’s repeated 2FA prompts slowed but did not stop their activity.

Synopsys said its investigation found no evidence of unauthorized access to its systems or customer technical data, and stated the threat actor had not contacted the company. Reporting also cast doubt on D1R’s proof-of-compromise claims: a screenshot presented as evidence of Bosch data exposure appeared to match a publicly available Bosch user manual, and Bosch did not confirm any breach, issuing only a general statement on its cybersecurity posture. The competing claims leave the alleged downstream exposure of Synopsys customers unverified, even as D1R attempts to pressure multiple high-profile firms with breach and leak assertions.