Over 800,000 VW electric vehicle owners' information compromised due to software glitch

The German automaker Volkswagen is facing challenges. The company plans to reduce production by about 700,000 vehicles and lay off more than 35,000 workers in its home country. Additionally, a massive data leak at its subsidiary software company Cariad exposed personal data, including geolocation data, of around 800,000 EV owners online and accessible for months. This information could be valuable to criminals for extortion purposes. Interestingly, a hacker association informed the company about this data leak after receiving a tip from an anonymous hacker.

Enter the giveaway by signing up for my free newsletter.

What you need to know about the data leak

According to Der Spiegel, Volkswagen is facing a significant data security issue after sensitive information, including movement data from 800,000 electric cars and the personal contact details of their owners, was left exposed on the internet. This data revealed detailed information about the precise locations where cars were parked, including private locations like people's homes, government buildings, and even questionable spots like brothels.

The data exposed reveals detailed movement patterns of individuals, which can be used to create comprehensive profiles of their daily activities. This could be a cause for concern, particularly for public figures or those with privacy concerns.

Numerous car brands within the Volkswagen group, including VW, Audi, Seat, and Skoda, were impacted by a data breach that exposed sensitive information across various countries. The data was stored on Amazon cloud servers without proper security measures, leaving it vulnerable for an extended period before the problem was detected.

Over half of the 800,000 affected vehicles had detailed location data that allowed for mapping of drivers' daily routines, according to Spiegel. The list of affected users included German politicians, business leaders, the entire EV fleet used by Hamburg police, and suspected intelligence agents.

An anonymous hacker informed the Chaos Computer Club about the breach, which occurred while Volkswagen made the data accessible. There is no evidence yet that anyone misused or accessed it maliciously.

We attempted to contact Volkswagen for a comment but did not receive a response before our deadline.

How can this data leak affect you?

The Volkswagen data leak is not just a technical problem; it is a serious threat to privacy. With access to precise location data, someone could easily determine where you live, work, or spend your leisure time. This information could be exploited in numerous ways, including targeted scams, where hackers pose as Volkswagen or its partners to trick you into revealing sensitive information, to more personal threats such as stalking or harassment.

Your daily routine and visits to sensitive locations could be used to embarrass or blackmail you.

The breach poses risks for business leaders, government officials, and military personnel, as their movements linked to high-security or restricted areas could be exposed, increasing the likelihood of corporate espionage or national security threats. Additionally, when combined with other vulnerabilities, such as app credentials, hackers could potentially exploit the data to remotely control vehicles.

6 ways you can stay safe after this leak

In light of the recent Volkswagen data breach, it is imperative to take proactive measures to safeguard your personal data. Here are 6 ways you can stay safe after this leak:

Review and adjust your car's companion app settings to disable unnecessary location tracking and data sharing features. Keep your app up to date with the latest security patches.

Be cautious of scams: Be on the lookout for fraudulent emails, messages, or calls that claim to be from Volkswagen or affiliated services. Do not click on links or share personal information until you have confirmed the sender's identity.

3) Examine your car's settings to limit the collection of personal data through data opt-out options for vehicles with online features that allow data sharing functionalities to be disabled or reduced.

Update your email and passwords across multiple accounts immediately and enable two-factor authentication wherever possible to enhance security.

Physical mail scams can also follow a data breach, like the one that exposed your contact information. Be cautious of fraudulent letters that may pretend to be from Volkswagen or related services, asking for payments, personal details or directing you to fake websites.

Ensure that you have robust antivirus software installed on all your devices, particularly those linked to your vehicle or its apps. This can safeguard you from malicious links that infect your devices with malware, potentially exposing your private information. Additionally, this protection can alert you to phishing emails and ransomware scams, securing your personal information and digital assets. Get my top picks for the best 2025 antivirus protection options for your Windows, Mac, Android, and iOS devices.

Kurt’s key takeaway

The Volkswagen data leak highlights the need for companies to prioritize user data security. Revealing personal information and precise locations is not just a technical error, but a violation of trust. Although VW has fixed the issue, the damage demonstrates the importance of businesses being more accountable with the data they collect. Customers have a right to know that their information is secure and used only when necessary. If companies cannot safeguard their customers' privacy, they risk losing their trust entirely. It is time for the industry to take responsibility and improve data security practices.

Should stricter regulations be implemented for companies handling user data? Share your thoughts by writing to Cyberguy.com/Contact.

To receive my tech tips and security alerts, sign up for my free CyberGuy Report Newsletter at Cyberguy.com/Newsletter.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2024 CyberGuy.com. All rights reserved.