Toyota confirmed that the vehicle data of 2.15 million users in Japan was made public by mistake.
Not only is this information available to the public, the data – from its main cloud service platforms – is viewable for a decade due to human error.
The company said this data was mistakenly set to public view and likely included details such as vehicle location and vehicle device identifiers.
Toyota confirmed there were no reports of malicious use, while its local branch said no customers were affected.
A Toyota Australia spokesperson said: “Toyota Australia has been informed that the cloud service platforms are based in Japan and are not linked to any of the services we offer in Australia and are therefore not any Australian vehicle or customer data has been compromised.”
“There is a lack of active detection mechanisms and operations to detect the presence or absence of things that have become public,” said a Toyota spokesperson. Reuters when asked how the violation went unnoticed for so long.
It started in November 2013 and lasted until mid-April.
The issue affects owners of both Toyota and Lexus vehicles using T-Connect and G-Link connectivity services, including those who have signed up for features like emergency dialing.
The company is currently investigating all cloud environments managed by Toyota Connected Corp.
Toyota says it will introduce a system to audit cloud installations, set up a system to continuously monitor these and train its employees on how to handle data securely.
This incident follows a similar T-Connect data breach that the company confirmed last October.
Toyota said 296,019 email addresses and customer numbers were likely leaked, affecting customers who signed up for the T-Connect website from July 2017 onwards.
