Tuesday, May 28, 2024

Toyota Discloses Data Breach – Customers’ Personal Information Exposed

Toyota Motor Corporation reveals a data breach that may have compromised the personal information of its customers after an access key was made available to the public on GitHub for over five years.

The data breach at Toyota Kirloskar Motor, a joint venture with Indian giant Kirloskar Group, has been reported to the appropriate Indian authorities, according to Toyota India.

“Toyota Kirloskar Motor (TKM) has been notified by one of its service providers of an incident that might have exposed the personal information of some of TKM’s customers on the internet”, Toyota Kirloskar Motor (TKM) stated in an email statement.

A Portion of T-Connect Site Source Code Published On GitHub

The carmaker recently learned that some of the source code for its T-Connect website was unintentionally posted on GitHub. The report stated that around 296,000 customer records may have been compromised due to this issue.

The company built the T-Connect app, which gives car owners access to the infotainment system of their vehicle and allows them to keep an eye on who has access to it.

Along with the code, the data server access key that held client data such as email addresses and management numbers was also included. By a developer subcontractor, the source code was exposed.

“In December 2017, the “T-Connect” website development subcontractor mistakenly uploaded part of the source code to their GitHub account while it was set to be public, in violation of the handling rules”, according to the notice published by the company.

“This incident was caused by the inappropriate handling of the source code by the development contractor company. We will proceed”.

According to the reports, between December 2017 and September 15, 2022, an unauthorized third party might have had access to the information of Toyota consumers. 296,019 clients are affected, the GitHub repository was locked in September 2022, and the keys were modified.

Although there are no indications of data theft, the Japanese manufacturer comes to the conclusion that it is impossible to completely rule out the possibility that someone may have accessed and stolen the data.

“As a result of an investigation by security experts, although we cannot confirm access by a third party based on the access history of the data server where the customer’s email address and customer management number are stored; at the same time we cannot completely deny it. We now have.” reads the notice published by the company.

Notably, the Company declared that it will apologize and notify each affected consumer separately. Toyota has set up a separate form for users to check if their data was exposed on its website.

Lookout for Scams

Users of T-Connect who signed up between July 2017 and September 2022 may be subject to scams and other types of fraud. The company advises customers to be on the lookout for such scams.

Here it’s possible that spam emails like “spoofing” or “phishing schemes” could be sent using email addresses. 

“If you receive a suspicious e-mail with an unknown sender or subject, there is a risk of virus infection or unauthorized access, so please do not open the attached file and immediately delete the e-mail itself. Please be careful when accessing the address (URL) described in the email”, reads the notice.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Website

Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles