According to the German newspaper Spiegel Netzwelt, Volkswagen‘s software subsidiary Cariad has suffered a large-scale data breach that affected 800,000 electric car owners. The leak left personal information online for months, including travel and contact information.
This included the exact location data of 460,000 VW, Seat, and Audi vehicles. According to reports, the information was available through Amazon’s cloud storage platform. There is a positive side to this. Cariad says that despite the accessibility, no attacker has gained access to the exposed data. The bona fide hacker association Chaos Computer Club (CCC) noticed the leak on November 26 and brought it to the company’s attention.
VW’s statement, which was reviewed by the German news agency DPA, said that the error had been corrected, so the information was no longer available. In addition, the company noted that the leak only affected location and contact information, as passwords and payment data were not affected. The company added that initially only individual vehicles registered on online services were at risk, noting that “access to the data was gained through a very complex, multi-step process.”
According to Volkswagen, the CCC hacker group was only able to access pseudonymized vehicle data, which did not allow it to draw any conclusions about specific customers. This was done “only by bypassing several security mechanisms, which required a high level of skill and a significant investment of time.”
In other words, the affected customers should not worry too much that their location data could be collected by malicious actors from the dark web. The company has launched an investigation into the matter and will decide on further steps once it is completed.
As modern vehicles become more and more online, this opens them up to many new risks. Just last year, a viral TikTok challenge taught Hyundai users how to hack into their cars, leading to more than a dozen accidents and eight deaths.
