Personal information of 800,000 electric car owners leaked

Due to a massive data breach at Cariad, Volkswagen’s automotive software company, location data and other sensitive information of 800,000 owners of electric vehicles was exposed.

Thanks to a whistleblower, researchers of the Chaos Computer Club (CCC) discovered a publicly accessible memory dump from an internal application of Cariad.

The dump contained login credentials for the company’s Amazon cloud storage. There researchers found 9.5 terabytes of data from 800,000 electric cars, including details from Volkswagen, Seat, Audi and Skoda vehicles.

The cloud storage included information about owners, such as time and place where they parked their car. In addition, accurate location data of nearly half a million vehicles could be viewed.

The data was collected through the Volkswagen app, which allows car owners to pre-heat their car, view the car’s battery charge level, or check the current range.

The CCC informed Cariad, the Volkswagen Group and privacy regulators about the vulnerability.

The whistleblower not only informed the CCC, but also Der Spiegel. The German news outlet found out that sensitive information of politicians, businessmen, police officers and intelligence operatives was collected by Volkswagen’s subsidiary.

In a response to Der Spiegel, a Cariad spokesperson said that the data is collected to improve the software, but that the company never intended to provide information about individuals and their movements in daily life.

Cariad doesn’t call the incident a data breach, but rather considers it a ‘misconfiguration’. “According to current knowledge, no one has accessed the systems except the CCC and we have no evidence of misuse of data by third parties,” the spokesperson adds.

He states that customers don’t have to worry, because no sensitive data such as passwords or payment data was involved.

“The problem is that this data is collected at all and stored over such a long period of time. The fact that they were poorly protected only puts the crown on the whole thing,” Linus Neumann, spokesman for the CCC, said in a statement about the incident.