The data, left unsecured by VW’s software division Cariad, included precise geolocation for 460,000 vehicles. It also tied many profiles to driver contact details, offering a strikingly invasive look at the lives of those behind the wheel.
A Digital Trail for All
According to reports, movement data was detailed enough to create profiles of EV users’ daily lives, revealing where they worked, shopped, or vacationed. More alarmingly, potential risks included targeting by fraudsters, stalkers, or blackmailers—especially for those with sensitive routines.
“Imagine your car data showing visits to a rehab clinic or a brothel. This isn’t just embarrassing; it could lead to blackmail or other exploitation,” noted Linus Neumann, a spokesperson for the Chaos Computer Club (CCC), which flagged the breach to VW and authorities.
A Breach of Trust
The root cause? Cariad, set up to lead VW’s software transformation, failed to secure data on an Amazon Web Services (AWS) cloud server. The vulnerability went unnoticed until a whistleblower contacted Der Spiegel and CCC, which gave VW 30 days to fix the issue before public disclosure.
In response, VW said it resolved the vulnerability and reassured customers that passwords and payment details were not affected. Yet critics argue the lapse highlights systemic weaknesses, particularly as automakers gear up for a future of autonomous driving.
Beyond the embarrassment, the breach raises critical questions about data privacy in an era where cars double as rolling computers. Insecure systems could become liabilities for automakers, eroding trust and inviting tighter regulations.
For VW, the incident underscores a harsh reality: in the race toward digital transformation, robust cybersecurity can no longer be an afterthought.