Volkswagen discloses data breach, 3.3 million customers impacted

Volkswagen America discloses a data breach at a third-party vendor that exposed the personal details of more than 3.3 million of its customers.

Volkswagen America discloses a data breach suffered by a third-party vendor used by the car vendor for sales and marketing purposes. The security breach affected a subsidiary Audi and authorized dealers in the U.S. and Canada and exposed the personal details of more than 3.3 million Volkswagen customers, most of which were owners of Audi cars.

According to a letter sent by the company to the Maine Attorney General and reported by TechCrunch, the subsidiary company left customer data spanning 2014 to 2019 unsecured online between August 2019 and May 2021.

Volkswagen learned of the data breach on March 10 and immediately launched an investigation in the case with the help of external consultants and notified law enforcement.

“The investigation confirmed in early May 2021 that a third party obtained limited personal information received from or about United States and Canadian customers and interested buyers from a vendor used by Audi, Volkswagen, and some authorized dealers.” reported TechCrunch. “This included information gathered for sales and marketing purposes from 2014 to 2019. VWGoA believes the data was obtained when the vendor left electronic data unsecured at some point between August 2019 and May 2021, when VWGoA identified the source of the incident.”

Exposed data for over 97% of the individuals includes personal information about customers and prospective buyers, including name, personal or business mailing addresses, email addresses, and phone numbers.

For some individuals, the data also include information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color, and trim packages.

“For approximately 90,000 Audi customers or interested buyers, the data also includes more sensitive information relating to eligibility for a purchase, loan, or lease. Nearly all of the more sensitive data (over 95%) consists of driver’s license numbers. A very small number of records include data such as dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers.” continues the letter.

But more than 90,000 customers across the U.S. and Canada had more sensitive data exposed and for them, VWGoA is going to offer free credit protection services to these approximately 90,000 individuals through IDX.ù

At the time of this writing, it is not clear if the data exposed was misused, anyway their leak pose a risk of fraud and other malicious activities for the car owners.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, data leak)