Ever get the sense that you’re being tracked? Well, if you’re a Toyota driver, you may have been. Toyota has disclosed in a statement that the locations of 2,150,000 of its customers were at risk of breach between November 6, 2013, and April 17, 2023.
Information that was at risk specifically included the vehicle GPS and navigation terminal ID number, the chassis number, and the location of the vehicle with time data. This information is related to Toyota’s cloud-based Connected service, which is used to remind owners to get maintenance done, stream entertainment in the car, and help find owners during emergency situations. Users who used services like Toyota Connected, G-Link, and G-Book were potentially affected.
Another statement from Toyota notes that video recordings could have also been leaked as part of the issue. These recordings would have been taken outside of the car.
It’s important to note that the data was simply at risk of being accessed — but Toyota says that there’s no evidence that it was actually misused in any way. Also, while the data did include location information, there was no personally identifiable information — so unless a potential bad actor knew the VIN (or chassis) number of a car, they wouldn’t have been able to use the data to track someone in particular.
Still, a VIN number is relatively easy to find, so if a hacker had access to the data, and enough motivation to track someone, it’s entirely possible that they could have done so. Toyota says that the issue has been fixed and that the data is no longer accessible.
In case you’re wondering if your car was affected as part of the issue, Toyota says that it has sent apology notices to all affected customers, and it has set up a call center to handle related queries.
This is not the first data leak to affest Toyota in recent times. Late last year, the company disclosed that email addresses of almost 300,000 customers were leaked on an accidentally public GitHub account. Like in the new data issue, at the time, Toyota said that there was no evidence of anyone actually accessing the leaked information.
