Volkswagen says a vendor’s security lapse exposed 3.3 million drivers’ details – TechCrunch

Volkswagen says a vendor’s security lapse exposed 3.3 million drivers’ details
Zack Whittaker@zackwhittaker / 2:13 PM GMT+1•June 11, 2021
Comment
GERMANY-AUTOMOBILE-VOLKSWAGEN
Image Credits: Jens Schlueter (opens in a new window)/ Getty Images
Volkswagen says more than 3.3 million customers had their information exposed after one of its vendors left a cache of customer data unsecured on the internet.

The car maker said in a letter that the vendor, used by Volkswagen, its subsidiary Audi and authorized dealers in the U.S. and Canada, left the customer data spanning 2014 to 2019 unprotected over a two-year window between August 2019 and May 2021.

The data, which Volkswagen said was gathered for sales and marketing, contained personal information about customers and prospective buyers, including their name, postal and email addresses, and phone number.

But more than 90,000 customers across the U.S. and Canada also had more sensitive data exposed, including information relating to loan eligibility. The letter said most of the sensitive data was driver’s license numbers, but that a “small” number of records also included a customer’s date of birth and Social Security numbers.

How to respond to a data breach



Volkswagen would not name the vendor, when asked. “We have also informed the appropriate authorities, including law enforcement and regulators, and are working with external cybersecurity experts and the vendor to assess and respond to this situation,” said a spokesperson, via a crisis communications firm.

It’s the latest security incident involving driver license numbers in recent months. Insurance giants Metromile and Geico admitted earlier this year that their quote forms had been abused by scammers trying to obtain driver license numbers. Several other car insurance companies have also reported similar incidents involving the theft of driver license numbers. Geico said it was likely an effort by scammers to file and cash fraudulent unemployment benefits in another person’s name.

Volkswagen’s letter, however, did not say if the company had evidence that the data exposed by the vendor was misused.