Toyota cloud misconfiguration exposed vehicle data for 2.15 million customers

Toyota Motor Corporation disclosed on May 12, 2023 that a misconfigured cloud environment had left vehicle data belonging to about 2.15 million customers in Japan publicly accessible for close to a decade.

The exposure affected people who used Toyota's T-Connect, G-Link, G-Link Lite or G-BOOK services. The company said the data was reachable without authentication from November 6, 2013 until April 17, 2023, when access was blocked.

Exposed records included in-vehicle GPS navigation terminal identifiers, chassis numbers and vehicle location histories with timestamps. A further portion of the data covered video footage recorded by vehicle drive recorders between November 2016 and April 2023. Toyota maintained that the information could not on its own identify individual owners, though the breadth of the location histories drew scrutiny from security researchers.

Toyota attributed the incident to human error in configuring the cloud database and said insufficient enforcement of internal data handling rules had allowed the mistake to go undetected. It said it had not seen any reports that the data had been obtained or maliciously used, and had not confirmed any secondary damage.

The company apologized, opened a dedicated call center for affected customers and said it would begin auditing and monitoring cloud settings across its connected services. About three weeks later, on May 31, 2023, Toyota disclosed further cloud misconfigurations affecting roughly 260,000 customers in Japan plus an undisclosed number in Asia and Oceania.