Toyota Discloses Decade-Long Data Leak Exposing 2.15M Customers' Data
A misconfigured cloud instance exposed vehicle data, but not personally identifiable information, the car maker says.
Toyota has disclosed that for more than 10 years, a misconfigured cloud bucket left more 2.15 million customer records exposed to the open Internet.
According to the disclosure, the sensitive data from Toyota's cloud-based Connected services was open to unauthorized access from November 2013 to this April. The Toyota Connected offering allows drivers to stream entertainment, use location data to find stolen vehicles, receive flash maintenance reminders, and send for emergency help in case of an accident.
Toyota spokesperson Hideaki Homma told Associated Press that the Connected service breach only impacts customers in Japan. Any unauthorized access to the data would not identify individual customers, the carmaker said in its statement, adding that there has not been any observed use or abuse of the data from a third party.
"We believe that the main reason for this incident was insufficient explanation and thoroughness of rules for data handling," a Google translation of the Toyota data breach disclosure statement read. "(We will) collaborate closely with the [Toyota corporation], thoroughly educate employees, work to prevent recurrence, introduce a system to audit the cloud settings, conduct a setting survey of the cloud environment, and continuously monitor the setting status. We will build a system."
This isn't the first security incident for the automaker this year. Just in March, a hacker made headlines by exploiting a flaw in Toyota's C360 customer relationship management (CRM) software, exposing the personal data of an unknown number of the company's customers in Mexico.
About the Author
You May Also Like
A Cyber Pros' Guide to Navigating Emerging Privacy Regulation
Dec 10, 2024Identifying the Cybersecurity Metrics that Actually Matter
Dec 11, 2024The Current State of AI Adoption in Cybersecurity, Including its Opportunities
Dec 12, 2024Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024