VW: Hackers uncover data leak in 800,000 Volkswagen cars

According to a media report, there was a data leak at the VW software subsidiary Cariad. Movement data from 800,000 electric cars in Europe as well as contact information about the owners are said to have been unprotected on the Internet, as “Spiegel” reports.

Because of a software error, data from VW, Seat, Audi and Skoda vehicles were accessible in Amazon cloud storage for months, the paper writes. Precise location data is said to have been visible for 460,000 vehicles, which would have allowed conclusions to be drawn about the lives of the people behind the steering wheels.

The VW Group announced that the error has now been fixed. Sensitive information such as passwords or payment details were not affected. Except for the Chaos Computer Club (CCC), which alerted Cariad to the error on November 26th, no one accessed the data, it said in a statement.

Only data from selected vehicles that were registered for online services and had online connectivity were affected. According to the company, this involved data on charging behavior and charging habits in order to optimize battery and charging software. “The data was accessed in a very complex, multi-stage process.”

The CCC was able to access pseudonymized vehicle data that did not allow any conclusions to be drawn about individual people. “Only by bypassing several security mechanisms that required a high level of expertise and a significant amount of time, as well as by combining different data sets, was the CCC able to draw conclusions about individual customer data from specific users,” it continues.

The CCC never had access to vehicles. “The final analysis of the incident has not yet been completed and requires further effort due to its complexity.” Once this analysis has been completed, further steps will be decided if necessary.