VW Group's massive EV data leak affects 800,000 EVs

In a digital age, data is gold, and the automotive industry clearly struggles with a growing challenge: safeguarding the privacy of its customers. The latest incident involving the Volkswagen Group has exposed the urgent need for car manufacturers to pay a lot more attention to cybersecurity.

A massive data leak exposed the sensitive information of 800,000 electric vehicle owners across VW, Audi, Seat, and Skoda brands. This breach originated from a misconfigured Amazon cloud storage system used by VW's software company Cariad, and it allowed access to GPS coordinates, battery charge levels, and other vehicle status details.

The exposed data was easily accessible through freely available software. It allowed anyone with the right knowledge to track vehicle movements and even connect them to owners' personal credentials. The location data was precise enough in 466,000 cases to create detailed profiles of owners' daily habits. The list of those affected includes German politicians, entrepreneurs, police officers, and even suspected intelligence service employees.

The breach came to light thanks to an anonymous whistleblower who alerted the Chaos Computer Club (CCC), Europe's largest hacker association. CCC promptly contacted relevant authorities and gave VW Group and Cariad 30 days to rectify the issue. Cariad's technical team apparently responded swiftly, and blocked unauthorized access to the data. Better late than never.

This isn't the first time an automaker has faced a major data breach. Last year, Toyota admitted to a breach affecting 2.15 million vehicle owners in Japan. These incidents underscore the automotive industry's need to improve its cybersecurity measures as connectivity features and cloud-based services become increasingly common in modern vehicles.

Via