> JapanHacked_
[Contained][Severity: Critical][Misconfiguration]

Toyota Motor: T-Connect source code was left public, and 296,019 email addresses and other data may have leaked

A development contractor had left source code, including the access key to a data server, public on GitHub. It was found on September 15 and made private.

Disclosed

2022-10-07

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It found that the source code was public and made it private the same day. [1]

  2. It changed the access key of the data server. [1]

  3. It announced the case. [1]

Impact

From December 2017 to September 15, 2022, the company that was entrusted with web development had left the source code of the T-Connect user site public on GitHub. The code contained the key to a data server, and 296,019 email addresses and customer management numbers may have been viewed. The access logs show no viewing by third parties, but it cannot be ruled out. [1]

Timeline

  1. Detected 2022-09-15
  2. Disclosed 2022-10-07
  3. 22 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]お客様のメールアドレス等の漏洩可能性に関するお詫びとお知らせについて | コーポレート | グローバルニュースルーム | トヨタ自動車株式会社 公式企業サイトToyota Motor Corporation · 2022-10-07