Vehicle data and customer information were exposed for over eight years due to a cloud misconfiguration at Toyota Motor that impacted over 260,000 customers. Credit: Magdalena Petrova Japanese automaker Toyota said approximately 260,000 customers’ data was exposed online due to a misconfigured cloud environment. Along with customers in Japan, data of certain customers in Asia and Oceania was also exposed.Toyota has implemented measures to block access to the data from the outside and is investigating the matter including all cloud environments managed by Toyota Connect (TC).“We sincerely apologize to our customers and all relevant parties for any concern and inconvenience this may have caused,” Toyota said in a statement. Following the investigation, the automobile maker has also implemented a system to monitor the cloud environment. “As we believe that this incident also was caused by insufficient dissemination and enforcement of data handling rules, since our last announcement, we have implemented a system to monitor cloud configurations,” Toyota said. Currently, the system is in operation to check the settings of all cloud environments and to monitor the settings on an ongoing basis.“In addition, we will work closely again with TC to explain and thoroughly enforce the rules for data handling,” Toyota said in the statement. Toyota has also confirmed that there was no evidence of any secondary use or third-party copies of data remaining on the Internet. “At present, we have not confirmed any secondary damage,” Toyota said.The data leak was first reported by Toyota on May 12. “It was discovered that part of the data that Toyota Motor Corporation entrusted to Toyota Connected Corporation to manage had been made public due to misconfiguration of the cloud environment,” Toyota said on May 12, according to a machine translation of the statement in Japanese.Customers’ vehicle data was exposedIn-vehicle device ID, map data updates, updated data creation dates, and map information and its creation date (not vehicle location) have potentially been accessible externally. Data from approximately 260,000 customers were exposed in the incident. These include customers who subscribed to G-BOOK with a G-BOOK mX or G-BOOK mX Pro compatible navigation system, and some customers who subscribed to G-Link / G-Link Lite*1 and renewed their Maps’ on Demand service between February 9, 2015, and March 31, 2022, Toyota said.The data was exposed from February 9, 2015, to May 12, 2023. “In principle, the above customer information is automatically deleted from the cloud environment within a short period after the map data is distributed and is not continuously stored or accumulated during the above period,” Toyota said.Customers whose information may have been leaked will receive a separate apology and notification to their registered email addresses from the company. Overseas customer data exposedSome of the files that TC manages in the cloud environment for overseas dealers’ maintenance and investigation of systems were potentially accessible externally due to a misconfiguration, Toyota said.The address, name, phone number, email address, customer ID, vehicle registration number, and vehicle identification number of certain customers in Asia and Oceania were potentially exposed externally. This data was exposed from October 2016 to May 2023.“We will deal with the case in each country in accordance with the personal information protection laws and related regulations of each country,” Toyota said. Data leak reported last yearThis is not the first time that customer data of Toyota has been leaked. Last year in October, Toyota reported that customers’ personal information may have been exposed externally after an access key was publicly available on GitHub for almost five years.Toyota T-Connect is the official connectivity app that allows owners of Toyota cars to link their smartphone with the vehicle’s infotainment system for phone calls, music, navigation, notifications integration, driving data, engine status, fuel consumption, etc. A portion of the T-Connect site source code was published on GitHub and contained an access key to the data server that stored customer email addresses and management numbers.Details of 296,019 customers were exposed between December 2017 and September 15, 2022. Related content news FBI offers to share 7,000 LockBit ransomware decryption keys with CISOs It’s not clear how many of the decryption keys are still viable, but it’s likely to be a boon for many enterprise victims who did not pay the ransom. By Evan Schuman Jun 06, 2024 4 mins Ransomware how-to Download our password managers enterprise buyer’s guide While it may seem counterintuitive to entrust security to a single password manager app accessed by a single password, using a password manager is in fact a very good idea. Here’s what you need to know to choose a password manager for your busi By Josh Fruhlinger and Tim Ferrill Jun 06, 2024 1 min Password Managers Enterprise Buyer’s Guides news Complaints in EU challenge Meta’s plans to utilize personal data for AI The complaint underscores wider privacy concerns and raises the question of whether model users or model creators are responsible for compliance with privacy rules. By Prasanth Aby Thomas Jun 06, 2024 4 mins Regulation Data Privacy Generative AI opinion What CISOs need to know about Microsoft’s Copilot+ The Recall feature of Microsoft’s AI-powered Copilot+ introduces some potential security risks by capturing and storing user activity. By Susan Bradley Jun 06, 2024 8 mins Windows Security Security Software PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe