Toyota has revealed that customer information in several countries across Oceania and Asia, excluding Japan, may have been publicly accessible from October 2016 to May 2023. The exposed data included names, addresses, phone numbers, email addresses, and vehicle identification and registration numbers. This incident follows an earlier announcement by Toyota regarding the public availability of vehicle data for 2.15 million users in Japan. The company attributed these incidents to insufficient dissemination and enforcement of data handling rules.
The automaker discovered the latest issue while conducting a comprehensive investigation into its cloud environments managed by Toyota Connected, prompted by the previous incident. The problem originated from an error in the cloud environment where customer data collected by overseas dealers for vehicle maintenance inspections was stored. Toyota has not disclosed the number of affected customers, the specific countries involved, or whether Lexus brand customers were impacted.
Toyota is currently investigating the incident according to the laws and regulations of each affected country. The company stated that only a portion of the customers’ information may have been externally accessible. It also confirmed that there is no evidence of third-party copies or use of the customer data, and sensitive information like vehicle location and credit card details were not compromised.
Toyota has implemented a system to monitor cloud configurations to prevent similar incidents in the future. The company initially discovered the incident during routine inspections conducted from April 7 onwards.
