Toyota Motor: a cloud misconfiguration at its contractor Toyota Connected left vehicle data of about 2.15 million customers viewable from outside

1. 2013-11-06

   A misconfiguration in the cloud environment managed by Toyota Connected made data accessible from outside. [1] [2]

2. 2023-04-17

   The period in which the data was accessible from outside ended. After the discovery it blocked access from outside. [1] [2]

3. 2023-05-12

   It announced the case. The investigation continues across all cloud environments managed by Toyota Connected. [1] [2]

4. 2023-05-31

   It published the results of a survey of all Toyota Connected cloud environments. In Japan, for about 260,000 customers of G-BOOK mX and other services, terminal IDs and map update data with its creation month were viewable from outside from February 9, 2015 to May 12, 2023. Location data and card information were not included. In the Asia and Oceania regions outside Japan, files containing address, name, phone number, email address, customer ID, vehicle registration number and chassis number were viewable. [3] [4]

5. 2023-07-12

   After guidance from the Personal Information Protection Commission on the domestic case, it published recurrence prevention measures. The cause was a staff member wrongly setting a cloud server to public and personal data being stored on a server that was already public. It named problems in technical safeguards, human safeguards and contractor management. It will technically restrict public settings on the cloud and monitor it continuously with a diagnostic tool, and will have its contractor Toyota Connected report on the measures twice a year. [5] [6]

The data that may have been viewed from outside is the vehicle terminal ID, chassis number, vehicle location and time of about 2,150,000 customers who contracted T-Connect, G-Link, G-Link Lite or G-BOOK from January 2, 2012 to April 17, 2023. These data alone do not identify the customers, and no secondary use by third parties, remaining copies or other secondary damage has been confirmed. It will introduce a system that audits cloud settings, survey the settings and monitor them continuously. [1] [2]