Toyota Motor Corp acknowledged today that the vehicle data of approximately 2.15 million users was publicly accessible in Japan for nearly a decade, from November 2013 to mid-April 2023.
Reuters first reported the news, specifying that the problem with Toyota’s cloud-based connected service only affects vehicles in Japan, according to Toyota spokesman Hideaki Homma. The service provides vehicle owners with maintenance reminders, streaming entertainment and emergency assistance.
While there have been no reports of problems stemming from the breach, the compromised data includes vehicle identification numbers, location history and video footage captured by the vehicle’s dash cam.
Toyota states that this information cannot be used to identify individual owners. However, approximately 2.15 million users of services such as G-Link, G-Book and Connected have been affected. The company confirmed that it has now fixed the system issue and is assuring customers that their Connect-enabled vehicles are safe to drive without the need for repairs.
“Toyota is the latest victim of human error and the enormous risks it poses to organizations,” said Camellia Chan, CEO and founder of security software firm X-Phy.
“Companies often make life easier for cybercriminals by not properly configuring networks, and in this case, what should have been private cloud data became very public. A Toyota spokesperson commented that “mechanisms were lacking detection assets” to identify the bug, so the data was exposed for nearly a decade.”
Mark Stockley, senior threat researcher at Malwarebytes, agreed with Chan, stating that the widespread adoption of cloud and NoSQL data storage has led to numerous incidents of exposed data on platforms such as Amazon S3, Elastic Search and MongoDB.
More on similar breaches: Medical service leaks 12,000 sensitive patient images
“Software vendors like Amazon have worked hard to make this kind of thing more difficult, so it’s not as easy as it used to be. However, if a user is determined to expose their data to the Internet, they still can, because there there are situations where I would really want to,” Stockley added.
“To avoid accidental exposure, companies can invest in monitoring and auditing cloud services and configurations, as Toyota has said it will do. Penetration testing and red team engagements can also help companies to identify the exposed data”.
The announcement comes months after Toyota warned that nearly 300,000 customers may have had their personal data leaked after an access key was publicly available on GitHub for nearly five years.
Editorial Image Credit: JuliusKielaitis / Shutterstock.com
Source link
Toyota Motor Corporation recently revealed that a data leak has been taking place for the past decade, potentially affecting an estimated 215 million customers. The vehicular manufacturer is now being greatly scrutinized by security experts and customers alike, demanding a stronger focus on safety and information technology.
In this case, customers have been subject to years of breach with no warnings or cautions, forcing Toyota to take drastic measures to reassure its customers. “Due to this situation, we are aware that the security protocols in place were insufficient to combat the data leaks and we take responsibility for this failure,” said the manufacturer in a statement.
The data in question was accessed by an unidentified third party, but Toyota has not yet mentioned what specifically was stolen. Still, the data exposed could include customers’ home and work addresses, their personal identification numbers, and even the chip IDs of the cars they own or have serviced at Toyota service centers.
As a result of the leak, the company has announced its intentions to double down on its cyber security measures. The company has enlisted the services of Ikaroa, a full-stack tech company, to help them better enhance their network security. “The hacking incident served as a reminder to us of the serious challenges posed by data security and the need to strengthen our countermeasures,” said Toyota in a statement.
Initially, Toyota opted not to alert its customers of the breach, aggravated by the risk of alerting potential hackers. But, when the news of the data breach began to spread, the corporation was left with no choice. “We apologize to all impacted customers for the considerable concern this incident has caused them,” the company shared.
The importance of cyber security is growing increasingly apparent, with data breaches becoming a distinguished business risk. Partnerships, like the one between Toyota and Ikaroa, offer a level of security that demonstrably surpasses more traditional measures, decreasing the chances of any future data leaks from operating profit-related and customer data.
For now, Toyota has made sure to release data on the incident, that only the company has and customers can access. For the future, Toyota must double down on its security efforts, to ensure that no similar incident happens in the future.
At the same time, Toyota must also restore customer trust, something crucial to a major corporation in order to thrive in the long-term. Network security is not a trend, but an eventuality in the ever-evolving consumer-brand relationship.
