FlagThis

A significant data leak has exposed the location data of approximately 800,000 Volkswagen electric vehicles, including models from VW, Audi, Seat, and Skoda. This breach was a result of a cloud misconfiguration within Volkswagen's software subsidiary, Cariad, which stores data on Amazon Web Services. The leaked data included real-time GPS locations, with some being accurate to within ten centimeters, along with other sensitive information. The issue came to light after a whistleblower alerted the German newspaper Der Spiegel, and security researchers from the Chaos Computer Club also helped uncover the leak.

The exposed data potentially allows for the tracking of vehicle locations and could be linked to vehicle owners, their names, and contact details. This raises serious privacy concerns, and in some instances, it was possible to even determine the travel patterns of individuals, including two German politicians. The incident highlights the critical importance of robust cloud security practices by automotive manufacturers and their software subsidiaries. While Volkswagen claims accessing the data required bypassing security mechanisms, it underscores the severe consequences of mishandling sensitive customer information.

ImgSrc: d15shllkswkct0.cloudfront.net

References:

• electrek.co - Massive data leak at Volkswagen exposes locations of 800,000 EV drivers, for months - 8d
• Malware Analysis, News and Indicators - Latest topics - Almost 800K electric cars' data exposed by Cariad - 8d
• Techzine Global - Volkswagen data breach highlights major privacy risks - 8d
• CISO2CISO.COM & CYBER SECURITY GROUP - CISO2CISO article about exposed cloud server tracking 800,000 Volkswagen, Audi, and Skoda EVs. - 8d
• The Verge - All Posts - The Verge report on Volkswagen leak exposing location data for 800,000 electric cars. - 8d
• Electrek - Electrek article about massive data leak at Volkswagen exposing locations of 800,000 EV drivers. - 8d
• Latest from TechRadar - TechRadar article about over 800,000 electric car owners and drivers having private info exposed online. - 8d
• @cybernews - 800,000 Volkswagen owners' data was left unprotected and exposed. What are your thoughts? Read more⤵️ - 8d
• ciso2ciso.com - Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs – Source:hackread.com - 8d
• arstechnica.com - whistleblower-finds-unencrypted-location-data-for-800000-vw-evs - 8d
• TechCrunch - TechCrunch reports on a Volkswagen leak that exposed precise location data. - 8d
• www.engadget.com - Engadget reports huge Volkswagen data leak exposed the locations of 460,000 EV drivers. - 8d
• SCM feed for Security Strategy, Plan, Budget - Almost 800K electric cars' data exposed by Cariad - 8d
• pxlnv.com - Volkswagen Subsidiary Left Vehicle Location Data Unprotected in Amazon Storage - 8d
• siliconangle.com - Location data from 800,000 Volkswagen vehicles exposed by cloud misconfiguration - 8d
• Pixel Envy - Volkswagen Subsidiary Left Vehicle Location Data Unprotected in Amazon Storage - 8d
• www.carscoops.com - VW Group had sensitive info, including GPS coordinates, of 800K+ electric vehicles exposed on an unprotected AWS database for months before it was alerted - 8d
• Ars OpenForum - Whistleblower finds unencrypted location data for 800,000 VW EVs - 8d
• SiliconANGLE - Location data from 800,000 Volkswagen vehicles exposed by cloud misconfiguration - 8d
• @Techmeme - VW Group had sensitive info, including GPS coordinates, of 800K+ electric vehicles exposed on an unprotected AWS database for months before it was alerted (Thanos Pappas/Carscoops) - 8d
• @majorlinux - Why do they need the location data in the first place? Why does any company need this data? Volkswagen leak exposed location data for 800,000 electric cars - 8d
• Dataconomy - A data leak exposed the location data of approximately 800,000 Volkswagen (VW) electric vehicles (EVs) for several months, impacting vehicles from VW, Audi, Seat, and Skoda, as reported by Der Spiegel - 7d
• Mashable - Volkswagen leak exposed location of 800,000 electric car drivers for months - 7d
• @remixtures - Connected cars are great—at least until some company leaves unencrypted location data on the Internet for anyone to find. - 7d
• TechSpot - Volkswagen leak exposes private information of 800,000 EV owners, including location data - 7d
• discuss.techlore.tech - Volkswagen leak exposed location data for 800,000 electric cars - 7d
• @techlore - Volkswagen leak exposed location data for 800,000 electric cars - 7d
• @jbz - Cariad has since patched the vulnerability, which had revealed data about the usage of Skodas, Audis, and Seats, as well as what Motor1 calls "incredibly detailed data" for VW ID.3 and ID.4 owners. Th - 7d
• DMR News - Volkswagen Data Leak Exposed Location Data for 800,000 Electric Cars - 7d
• osint10x.com - Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs - 7d
• Osint10x - Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs - 6d
• @AlexJimenez - Volkswagen leak exposed location data for 800,000 electric cars The leak also included the emails, addresses, and phone numbers of drivers in some cases, Der Spiegel reports. - 6d

Classification:

• HashTags: DataLeak PrivacyViolation CloudSecurity
• Company: Volkswagen
• Target: Volkswagen EV Owners
• Product: EVs
• Feature: location tracking
• Type: DataBreach
• Severity: Major