byApurva Venkat
Special Correspondent
News
Jun 06, 20234 mins
Cloud SecurityData Breach
Vehicle data and customer information were exposed for over eight years due to a cloud misconfiguration at Toyota Motor that impacted over 260,000 customers.
Credit: Magdalena Petrova
Japanese automaker Toyota said approximately 260,000 customers’ data was exposed online due to a misconfigured cloud environment. Along with customers in Japan, data of certain customers in Asia and Oceania was also exposed.
Toyota has implemented measures to block access to the data from the outside and is investigating the matter including all cloud environments managed by Toyota Connect (TC).
“We sincerely apologize to our customers and all relevant parties for any concern and inconvenience this may have caused,” Toyota said in a statement.
Following the investigation, the automobile maker has also implemented a system to monitor the cloud environment.
“As we believe that this incident also was caused by insufficient dissemination and enforcement of data handling rules, since our last announcement, we have implemented a system to monitor cloud configurations,” Toyota said. Currently, the system is in operation to check the settings of all cloud environments and to monitor the settings on an ongoing basis.
“In addition, we will work closely again with TC to explain and thoroughly enforce the rules for data handling,” Toyota said in the statement.
Toyota has also confirmed that there was no evidence of any secondary use or third-party copies of data remaining on the Internet. “At present, we have not confirmed any secondary damage,” Toyota said.
The data leak was first reported by Toyota on May 12.“It was discovered that part of the data that Toyota Motor Corporation entrusted to Toyota Connected Corporation to manage had been made public due to misconfiguration of the cloud environment,” Toyota said on May 12, according to a machine translation of the statement in Japanese.
Customers’ vehicle data was exposed
In-vehicle device ID, map data updates, updated data creation dates, and map information and its creation date (not vehicle location) have potentially been accessible externally.
Data from approximately 260,000 customers were exposed in the incident. These include customers who subscribed to G-BOOK with a G-BOOK mX or G-BOOK mX Pro compatible navigation system, and some customers who subscribed to G-Link / G-Link Lite*1 and renewed their Maps’ on Demand service between February 9, 2015, and March 31, 2022, Toyota said.
The data was exposed from February 9, 2015, to May 12, 2023. “In principle, the above customer information is automatically deleted from the cloud environment within a short period after the map data is distributed and is not continuously stored or accumulated during the above period,” Toyota said.
Customers whose information may have been leaked will receive a separate apology and notification to their registered email addresses from the company.
Overseas customer data exposed
Some of the files that TC manages in the cloud environment for overseas dealers’ maintenance and investigation of systems were potentially accessible externally due to a misconfiguration, Toyota said.
The address, name, phone number, email address, customer ID, vehicle registration number, and vehicle identification number of certain customers in Asia and Oceania were potentially exposed externally. This data was exposed from October 2016 to May 2023.
“We will deal with the case in each country in accordance with the personal information protection laws and related regulations of each country,” Toyota said.
Data leak reported last year
This is not the first time that customer data of Toyota has been leaked.
Last year in October, Toyota reported that customers’ personal information may have been exposed externally after an access key was publicly available on GitHub for almost five years.
Toyota T-Connect is the official connectivity app that allows owners of Toyota cars to link their smartphone with the vehicle’s infotainment system for phone calls, music, navigation, notifications integration, driving data, engine status, fuel consumption, etc.
A portion of the T-Connect site source code was published on GitHub and contained an access key to the data server that stored customer email addresses and management numbers.
Details of 296,019 customers were exposed between December 2017 and September 15, 2022.
Related content
- newsTata Communications partners with Versa Networks on hosted SASE Hybrid work, SD-WAN, and digital-first adoption make enterprises more vulnerable to attack, increasing the need for SSE solutions, the company says.By Lynn GreinerJun 21, 20243 minsCloud SecurityNetwork Security
- newsOptus breach occurred due to a coding error, alleges ACMA New court fillings expose allegations of the communications authority claiming cyber attack was carried out "through a simple process of trial and error.”By Samira SarrafJun 21, 20244 minsData BreachData Privacy
- newsBeware PowerShell: Too-helpful users tricked into ‘fixing’ their machines with malware Attackers are using social engineering to get users to copy, paste, and run malicious scripts — all while thinking they are helping out the IT team.By Lynn GreinerJun 21, 20245 minsBrowser SecurityMalwareWindows Security
- feature5 biggest risks of using third-party service providers Outsourcing business services to a third-party provider might present risk to your organization’s security, reputation, and regulatory compliance. Sound third-party risk management is the answer.By Linda RosencranceJun 21, 20249 minsData and Information SecurityVendors and Providers
- PODCASTS
- VIDEOS
- RESOURCES
- EVENTS
SUBSCRIBE TO OUR NEWSLETTER
From our editors straight to your inbox
Get started by entering your email address below.
