Toyota Mobility Service: unauthorized access to the data server of its company car cloud "Booking Car", and about 25,000 people may be affected

1. 2020-10-01

   The Booking Car data storage server (AWS S3) could be accessed with an access key used before the system was developed. This state lasted until February 2, 2024. [1]

2. 2024-02-02

   It confirmed unauthorized entry using that access key. The same day it changed the access key and began monitoring. [1]

3. 2024-02-16

   It announced the case. It found unauthorized access to the data server storing email addresses and customer identification numbers, and deletion of stored data. It has not confirmed that personal data flowed out but could not fully rule it out. [1] [2]

It covers about 25,000 employees and staff of companies and local governments who registered an email address in Booking Car since November 2020. Besides email addresses and identification numbers, personal data in 17 items, including names, mobile phone numbers, face photos and vehicle images, may have leaked. It holds no credit card data. [1]

The cause was that, when the development contractor reused the AWS storage area from past product development, it did not disable or delete the access key set for another product. [1]