Volkswagen Customer Data Unprotected on The Internet

Apparently, detailed customer data on hundreds of thousands of VW vehicles could be viewed unencrypted online for months. Cell phone numbers and email addresses were also included. The German car manufacturer already has the next scandal on its hands.

Huge amount of data freely available

A several terabyte database with information on over 800,000 VW Group electric cars was apparently stored largely unprotected on an Amazon cloud server for several months. That’s what he’s reporting now Mirror who, along with the Chaos Computer Club, had received a tip-off about this fact. The data comes from VW, Seat, Audi and Skoda cars.

They can be used to create detailed location profiles for over 460,000 vehicles. It should also be possible to assign these profiles to specific people using the other unencrypted or non-anonymized data, which allows conclusions to be drawn about the lives of those affected. Data on the battery charge level, times and cell phone numbers as well as email addresses of the car owners could also be viewed.

The gap was not noticed

The VW subsidiary Cariad, which is responsible for developing the software platform for the vehicles and also arranges for the collection and storage of the data, is primarily responsible for this fiasco. Apparently the free accessibility of the information was not noticed there.

Cariad already made negative headlines in July. Due to major delays in the development of the new E3 2.0 software platform, VW had to postpone the release of several models such as the ID. Postponing golf by more than a year. The fact that collected customer data was now accessible online completely unprotected for months is likely to cause further damage to Volkswagen’s image. This clearly invalidates the argument that data is more secure with German companies than with American companies.

Not the first security breach at VW

After receiving notification of the security gap, Cariad at least reacted immediately. The data is now no longer freely accessible. Officially they spoke of a “misconfiguration”. Just a few weeks ago, security researchers found a gap in the system of Škoda vehicles. This made it possible to access the car’s on-board computer via Bluetooth from a distance of up to ten meters. In theory, the gap, which has now been closed, affected a good 1.4 million vehicles. VW didn’t cut a good figure here either.