D1R ransomware group claimed Synopsys, Bosch, and Arm breaches — Synopsys found no evidence

• It exploited a vulnerability in Synopsys's website to access a corporate client database containing approximately 40,000 entries .
• Using that database (including a file called TARGETLIST.txt), D1R claimed to have identified and subsequently breached Bosch and Arm as downstream targets .
• For Bosch, D1R specifically claimed to have stolen Bosch CAN module implementation data — sensitive engineering intellectual property — and set an 11-day deadline for Bosch to negotiate before the data would be publicly leaked .
• D1R also listed Arm, alleging a breach that included internal tools such as the "Athena Download Manager" .

The group posted what it claimed was Bosch CAN module implementation code on its leak site, saying it was releasing it "for free for every engineer and car enthusiast" .

Synopsys's response: "No evidence of a breach"

Synopsys publicly stated that its investigation found no evidence of unauthorized access to its systems or any customer technical data . Key details from multiple cybersecurity news outlets:

• Synopsys said the threat actor had not contacted the company to make any ransom demand .
• SecurityWeek reported that Synopsys's review found no proof that the claimed intrusion actually occurred .
• Multiple security analysts noted that D1R's "proof" — a screenshot presented as evidence of Bosch data — appeared to be composite or recycled from older leaks, casting further doubt on the claim's legitimacy .

The situation is complicated by the fact that Synopsys had a separate, real data breach in early 2026 (disclosed to Massachusetts regulators in April 2026) involving exposed Social Security numbers and medical information — but that was a different incident and is not connected to D1R's July claims .

Bosch's response: Investigating, no confirmation

Bosch did not issue a detailed public denial. According to dark web monitoring sources, the company was given 11 days to make contact and negotiate . Security reporting indicates Bosch was investigating the claims but had not confirmed any direct intrusion into its own systems . As of the most recent reporting (July 14-15, 2026), no major data leak of Bosch intellectual property had been independently verified .

Arm's status

Arm was listed as a victim, but D1R's specific claims regarding Arm received less independent verification compared to the Bosch allegations .

Where the situation stands

Key takeaway

Synopsys firmly denies the breach and has found no evidence to support D1R's claims. Bosch is still assessing. Independent analysts have cast significant doubt on D1R's credibility, but the situation remains open as of July 15, 2026.