Toyota Japan has apologized after admitting that it left the vehicle details of millions of customers on the public Internet for a decade.
He car manufacturer It said in a notice that it will notify some 2.15 million customers whose personal and vehicle information was exposed online after a “cloud misconfiguration” was discovered as recently as April. Toyota said the exposed data includes: registered email addresses; unique vehicle chassis and navigation terminal numbers; the location of the vehicles and what time they were there; and videos from the vehicle’s “driving recorder” that records images of the car.
toyota said the data spill of its Connected Cloud (TC) was initially exposed in November 2013, but pertains only to vehicles in Japan, according to the company.
The company’s connected service provides Toyota customers with information about their vehicle, provides in-car entertainment services and helps notify authorities in the event of an accident or breakdown.
Lexus car owners who have subscribed to the G-Link service are also affected.
Toyota said the data was protected, but has not seen any reports that the data was obtained or used maliciously. It’s unclear if Toyota has the registry in place to detect what, if any, data was pulled from its network. Toyota said in its statement that it would introduce a system to monitor its cloud, suggesting that its current efforts were insufficient.
In 2022, Toyota admitted it exposed around 300,000 customer email addresses for nearly five years after a subcontractor inadvertently uploaded part of the company’s source code to the Internet. That data included a private key that stored customers’ email addresses.
Do you know more about Toyota’s security lapse? Do you work at Toyota? You can reach Zack Whittaker at Signal at +1 646-755-8849 or zack.whittaker@techcrunch.com. You can also share files and documents with TechCrunch through our SecureDrop.
—————————————————-
Source link