Volkswagen car-location data-exposure incident - Revision history

Sojourna: /* The incident */

2026-03-09T03:30:53Z

The incident

← Older revision		Revision as of 03:30, 9 March 2026
Line 18:		Line 18:

	==The incident==		==The incident==
	[[File:Volkswagen.png\|alt=Pie ~~Chart~~ showing the total cars affected including the severity of each(whether its location was exposed down to a radius of 10cm or 10km) and breakdown by brand\|thumb\|Pie ~~Chart~~ showing the total cars affected and breakdown by brand]]		[[File:Volkswagen geo-location pie chart.png\|alt=Pie chart showing the total cars affected including the severity of each(whether its location was exposed down to a radius of 10cm or 10km) and breakdown by brand\|thumb\|Pie chart showing the total cars affected and breakdown by brand]]
	The core issue stemmed from a misconfiguration in Volkswagen's AWS storage implementation, which left customer data publicly accessible without proper authentication or access restrictions<ref name=":0" />. This exposed sensitive information about vehicle locations, EV-battery statistics and sensitive customer information. The incident not only breached customer trust, but Volkswagen's own [[Terms of Service]].		The core issue stemmed from a misconfiguration in Volkswagen's AWS storage implementation, which left customer data publicly accessible without proper authentication or access restrictions<ref name=":0" />. This exposed sensitive information about vehicle locations, EV-battery statistics and sensitive customer information. The incident not only breached customer trust, but Volkswagen's own [[Terms of Service]].

	==Industry context==		==Industry context==

Bythmusters: Added cargo template

2026-01-14T01:19:24Z

Added cargo template

@@ Line 1: / Line 1: @@
 {{OngoingEvent}}
+{{IncidentCargo
 In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.

AnotherConsumerRightsPerson: wrong template

2025-10-26T17:59:53Z

wrong template

← Older revision		Revision as of 17:59, 26 October 2025
Line 1:		Line 1:
			{{OngoingEvent}}

	~~''Note: This article represents an ongoing situation and may be updated as more information becomes available.''~~

	In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.		In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.

Mr Pollo: Removing under development template after months of no progress

2025-08-11T22:22:50Z

Removing under development template after months of no progress

← Older revision		Revision as of 22:22, 11 August 2025
Line 1:		Line 1:
	~~{{Under_Development~~
	~~\|date=January 2025~~
	~~\|stage=early~~
	~~\|priority=high~~
	}}

	''Note: This article represents an ongoing situation and may be updated as more information becomes available.''		''Note: This article represents an ongoing situation and may be updated as more information becomes available.''

Kostas: add category

2025-01-28T17:23:59Z

add category

← Older revision		Revision as of 17:23, 28 January 2025
Line 63:		Line 63:
	[[Category:CARIAD]]		[[Category:CARIAD]]
	[[Category:Incidents]]		[[Category:Incidents]]
			[[Category:Articles based on videos]]

BobBarone: /* References */

2025-01-27T00:14:15Z

References

← Older revision		Revision as of 00:14, 27 January 2025
Line 23:		Line 23:
	==Regulatory response==		==Regulatory response==

	The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems.<ref>https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/vehicle_cybersecurity_best_practices_01072021.pdf</ref><!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->		The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems.<ref>https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/vehicle_cybersecurity_best_practices_01072021.pdf. [https://web.archive.org/web/20210720041841/https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/vehicle_cybersecurity_best_practices_01072021.pdf Archived] from the original on July 20, 2021. Retrieved January 27, 2025.</ref><!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->

	==Broader implications==		==Broader implications==

Mingyee: Added reference

2025-01-23T14:13:10Z

Added reference

← Older revision		Revision as of 14:13, 23 January 2025
Line 23:		Line 23:
	==Regulatory response==		==Regulatory response==

	The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems.~~{{Citation needed\|date=January 2024\|reason=Letter reference needed}}~~<!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->		The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems.<ref>https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/vehicle_cybersecurity_best_practices_01072021.pdf</ref><!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->

	==Broader implications==		==Broader implications==

Mingyee: Fixed link

2025-01-23T14:10:13Z

Fixed link

← Older revision		Revision as of 14:10, 23 January 2025
Line 4:		Line 4:
	\|priority=high		\|priority=high
	}}		}}

			''Note: This article represents an ongoing situation and may be updated as more information becomes available.''

	In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.		In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.

	==Background==		==Background==

Line 37:		Line 40:
	*Drive times		*Drive times

	==See ~~Also~~==		==See also==
	*Data privacy		*Data privacy
	*[[Right to repair]]		*[[Right to repair]]
Line 43:		Line 46:
	*[[Volkswagen]]		*[[Volkswagen]]
	*[[2020 Massachusetts Right to Repair ballot initiative]]		*[[2020 Massachusetts Right to Repair ballot initiative]]
	*[[General Motors data ~~theft~~]]		*[[General Motors data collection and sharing controversy]]

	==References==		==References==
	<references />		<references />
	~~''Note: This article represents an ongoing situation and may be updated as more information becomes available.''~~
	<!-- commenting out to granular categories for the moment -->		<!-- commenting out to granular categories for the moment -->
	[[Category:Data breaches]]		[[Category:Data breaches]]

Mingyee: Proofreading

2025-01-23T14:08:37Z

Proofreading

← Older revision		Revision as of 14:08, 23 January 2025
Line 5:		Line 5:
	}}		}}

	In 2024, Volkswagen experienced a data security incident involving customer vehicle information stored on Amazon Web Services (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances ~~due to~~ a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.		In 2024, Volkswagen experienced a data-security incident involving customer vehicle information stored on [[Amazon Web Services]] (AWS). The incident occurred when Volkswagen's implementation of [[CARIAD]], a system used for storing terabytes of customer data, was discovered to have publicly accessible storage instances, because of a misconfiguration<ref name=":0">[https://cybersecuritynews.com/volkswagen-data-breach/]"Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked" written by Guru Baran (co-founder of Cyber Security News and GBHackers On Security). [https://archive.ph/tVDzM Archived] from the original on December 28, 2024. Retrieved on January 15, 2025.</ref>.
	== Background ==		==Background==

	This incident occurred within a broader context of automotive data security concerns. Modern vehicles increasingly collect and transmit various types of data, including location information, driving patterns, and user identification<ref name=":1">[https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/05/cars-consumer-data-unlawful-collection-use]"Cars & Consumer Data: On Unlawful Collection & Use" written in collaboration by the Office of Technology and the Division of Privacy and Identity Protection in the Bureau of Consumer Protection. [https://web.archive.org/web/20240514181955/https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/05/cars-consumer-data-unlawful-collection-use Archived] from the original on May 14, 2024. Retrieved January 15, 2025.</ref>. The automotive industry has previously faced scrutiny regarding data collection practices, with documented instances of manufacturers collecting and sharing vehicle data with third parties.		This incident occurred within a broader context of automotive data-security concerns. Modern vehicles increasingly collect and transmit various types of data, including location information, driving patterns, and user identification<ref name=":1">[https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/05/cars-consumer-data-unlawful-collection-use]"Cars & Consumer Data: On Unlawful Collection & Use" written in collaboration by the Office of Technology and the Division of Privacy and Identity Protection in the Bureau of Consumer Protection. [https://web.archive.org/web/20240514181955/https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/05/cars-consumer-data-unlawful-collection-use Archived] from the original on May 14, 2024. Retrieved January 15, 2025.</ref>. The automotive industry has previously faced scrutiny regarding data-collection practices, with documented instances of manufacturers collecting and sharing vehicle data with third parties.

	== The ~~Incident~~ ==		==The incident==
	[[File:Volkswagen.png\|alt=Pie Chart showing the total cars affected including the severity of each(whether its location was exposed down to a radius of 10cm or 10km) and breakdown by brand\|thumb\|Pie Chart showing the total cars affected and breakdown by brand]]		[[File:Volkswagen.png\|alt=Pie Chart showing the total cars affected including the severity of each(whether its location was exposed down to a radius of 10cm or 10km) and breakdown by brand\|thumb\|Pie Chart showing the total cars affected and breakdown by brand]]
	The core issue stemmed from a misconfiguration in Volkswagen's AWS storage implementation, which left customer data publicly accessible without proper authentication or access restrictions<ref name=":0" />. This exposed sensitive information about vehicle locations, EV battery statistics and sensitive customer information. The incident not only breached customer trust, but Volkswagen's own Terms of Service.		The core issue stemmed from a misconfiguration in Volkswagen's AWS storage implementation, which left customer data publicly accessible without proper authentication or access restrictions<ref name=":0" />. This exposed sensitive information about vehicle locations, EV-battery statistics and sensitive customer information. The incident not only breached customer trust, but Volkswagen's own [[Terms of Service]].

	== Industry ~~Context~~ ==		==Industry context==

	The incident highlighted ongoing discussions about automotive data security and privacy. Similar concerns were raised during the [[2020 Massachusetts Right to Repair ballot initiative]], where major automotive manufacturers including General Motors, Ford, Nissan, Toyota, and Honda invested approximately $25 million in campaign advertising discussing data security implications.		The incident highlighted ongoing discussions about automotive data security and privacy. Similar concerns were raised during the [[2020 Massachusetts Right to Repair ballot initiative]], where major automotive manufacturers including [[General Motors]], [[Ford]], [[Nissan]], [[Toyota]], and [[Honda]] invested approximately $25 million in campaign advertising discussing data security implications.

	== Regulatory ~~Response~~ ==		==Regulatory response==

	The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems{{Citation needed\|date=January 2024\|reason=Letter reference needed}}.<!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->		The National Highway Traffic Safety Administration (NHTSA) has previously expressed concerns about automotive data security. Following the 2020 Massachusetts Right to Repair initiative, NHTSA official Carrie Gules issued a letter addressing potential security vulnerabilities in vehicle data systems.{{Citation needed\|date=January 2024\|reason=Letter reference needed}}<!-- I couldn't find any specific letter that was referenced here, although there have been some sources saying that the NHTSA has taken part in Massachusetts Right to Repair regulations. -->

	== Broader ~~Implications~~ ==		==Broader implications==

	This incident demonstrates the broader challenges facing the automotive industry regarding data security and privacy. It has been documented that automotive manufacturers regularly collect various types of vehicle data<ref name=":1" />, including:		This incident demonstrates the broader challenges facing the automotive industry regarding data security and privacy. It has been documented that automotive manufacturers regularly collect various types of vehicle data,<ref name=":1" /> including:
	* Location information		*Location information
	* Driving patterns		*Driving patterns
	* Vehicle operation metrics		*Vehicle-operation metrics
	* User behavior data		*User-behavior data

	Some manufacturers have established partnerships with data aggregators and insurance companies for data-sharing purposes. For example, General Motors has been documented to share driving data with LexisNexis and insurance companies, including information about:		Some manufacturers have established partnerships with data aggregators and insurance companies for data-sharing purposes. For example, General Motors has been documented to share driving data with LexisNexis and insurance companies, including information about:

	* Vehicle location data		*Vehicle-location data
	* Turning radius information		*Turning-radius information
	* Stop times		*Stop times
	* Drive times		*Drive times

	== See Also ==		==See Also==
	* [[Data ~~Privacy]]~~		*Data privacy
	* [[Right to ~~Repair movement~~]]		*[[Right to repair]]
	* [[CARIAD]]		*[[CARIAD]]
	* [[Volkswagen ~~Group~~]]		*[[Volkswagen]]
	* [[2020 Massachusetts Right to Repair ballot initiative]]		*[[2020 Massachusetts Right to Repair ballot initiative]]
	* [[General Motors ~~Data Theft~~]]		*[[General Motors data theft]]

	== References ==		==References==
	<references />		<references />
	''Note: This article represents an ongoing situation and may be updated as more information becomes available.''		''Note: This article represents an ongoing situation and may be updated as more information becomes available.''
Line 54:		Line 54:
	<!-- [[Category:2024 in automotive industry]] -->		<!-- [[Category:2024 in automotive industry]] -->

	== Further Reading ==		==Further Reading==
	* [https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 For the link to the news source which was tipped off by a German hacktivist group]. [https://web.archive.org/web/20241227094207/https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 Archived] from the original on December 27, 2024. Retrieved January 15, 2025.		*[https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 For the link to the news source which was tipped off by a German hacktivist group]. [https://web.archive.org/web/20241227094207/https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 Archived] from the original on December 27, 2024. Retrieved January 15, 2025.
	* [https://www.youtube.com/watch?v=Agcp37iiWLc&t=188s Youtube video with mentioned credits for more information].		*[https://www.youtube.com/watch?v=Agcp37iiWLc&t=188s Youtube video with mentioned credits for more information].
	[[Category:Automotive privacy]]		[[Category:Automotive privacy]]
	[[Category:Right to repair]]		[[Category:Right to repair]]
	[[Category:CARIAD]]		[[Category:CARIAD]]
	[[Category:Incidents]]		[[Category:Incidents]]

Mingyee: Mingyee moved page Volkswagen Car Location Data Exposure Incident to Volkswagen car-location data-exposure incident: Misspelled title

2025-01-23T14:04:39Z

Mingyee moved page Volkswagen Car Location Data Exposure Incident to Volkswagen car-location data-exposure incident: Misspelled title

← Older revision		Revision as of 14:04, 23 January 2025
(No difference)