Cloud misconfiguration causes massive data breach at Toyota Motor

Japanese automaker Toyota said approximately 260,000 customers’ data was exposed online due to a misconfigured cloud environment. Along with customers in Japan, data of certain customers in Asia and Oceania was also exposed.

Toyota has implemented measures to block access to the data from the outside and is investigating the matter including all cloud environments managed by Toyota Connect (TC).

“We sincerely apologize to our customers and all relevant parties for any concern and inconvenience this may have caused,” Toyota  said in a statement.

Following the investigation, the automobile maker has also implemented a system to monitor the cloud environment.

“As we believe that this incident also was caused by insufficient dissemination and enforcement of data handling rules, since our last announcement, we have implemented a system to monitor cloud configurations,” Toyota said. Currently, the system is in operation to check the settings of all cloud environments and to monitor the settings on an ongoing basis.

“In addition, we will work closely again with TC to explain and thoroughly enforce the rules for data handling,” Toyota said in the statement.

Toyota has also confirmed that there was no evidence of any secondary use or third-party copies of data remaining on the Internet. “At present, we have not confirmed any secondary damage,” Toyota said.

The data leak was first reported by Toyota on May 12. “It was discovered that part of the data that Toyota Motor Corporation entrusted to Toyota Connected Corporation to manage had been made public due to misconfiguration of the cloud environment,” Toyota said on May 12, according to a machine translation of the statement in Japanese.

Customers’ vehicle data was exposed

In-vehicle device ID, map data updates, updated data creation dates, and map information and its creation date (not vehicle location) have potentially been accessible externally.

Data from approximately 260,000 customers were exposed in the incident. These include customers who subscribed to G-BOOK with a G-BOOK mX or G-BOOK mX Pro compatible navigation system, and some customers who subscribed to G-Link / G-Link Lite*1 and renewed their Maps’ on Demand service between February 9, 2015, and March 31, 2022, Toyota said.

The data was exposed from February 9, 2015, to May 12, 2023. “In principle, the above customer information is automatically deleted from the cloud environment within a short period after the map data is distributed and is not continuously stored or accumulated during the above period,” Toyota said.

Customers whose information may have been leaked will receive a separate apology and notification to their registered email addresses from the company.

Overseas customer data exposed

Some of the files that TC manages in the cloud environment for overseas dealers’ maintenance and investigation of systems were potentially accessible externally due to a misconfiguration, Toyota said.

The address, name, phone number, email address, customer ID, vehicle registration number, and vehicle identification number of certain customers in Asia and Oceania were potentially exposed externally. This data was exposed from October 2016 to May 2023.

“We will deal with the case in each country in accordance with the personal information protection laws and related regulations of each country,” Toyota said. 

Data leak reported last year

This is not the first time that customer data of Toyota has been leaked.  

Last year in October, Toyota reported that customers’ personal information may have been exposed externally after an access key was publicly available on GitHub for almost five years.

Toyota T-Connect is the official connectivity app that allows owners of Toyota cars to link their smartphone with the vehicle’s infotainment system for phone calls, music, navigation, notifications integration, driving data, engine status, fuel consumption, etc. 

A portion of the T-Connect site source code was published on GitHub and contained an access key to the data server that stored customer email addresses and management numbers.

Details of 296,019 customers were exposed between December 2017 and September 15, 2022.