Data on more than 2 million Toyotas in Japan were at risk in breach

TOKYO — A decade-long data breach in Toyota’s much-touted online service put some information on more than 2 million vehicles at risk, the Japanese automaker said Friday.

Spanning from January 2012 to April 2023, the problem with Toyota’s cloud-based Connected service pertains only to vehicles in Japan, said spokesperson Hideaki Homma.

The Connected service reminds owners to get maintenance checks and links to streaming entertainment and provides help during emergencies. It can call for help after a crash or locate a car that’s been stolen.

No issues arising from the breach have been reported so far.

Although there is no evidence any information was leaked, copied or misused due to the breach, the data at risk includes: the vehicle identification number, which is separate from the license plate; the location of the vehicle and at what time it was there; and video footage taken by the vehicle, known as the “drive recorder” in Japan.

Such information cannot be used to identify individual owners, according to Toyota Motor Corp., which makes the Prius hybrid and Lexus luxury models.

Vehicles belonging to about 2.15 million people have been affected, including those who used net services called G-Link, G-Book and Connected.

Toyota’s Connected service in Japan is operated by a subsidiary. Until recently, no one noticed outside access to such information should have been turned off, Homma said.

“We are so sorry to have caused such trouble to all the people,” he said.

The problem is a major embarrassment for Japan’s top automaker, which has built a reputation for quality and attention to detail.

Automakers worldwide are competing to differentiate model offerings with the latest technology to lure buyers.

The problem with the system has been fixed, Homma said, so it’s safe to continue driving Connect-enabled vehicles as usual, and there is no need to bring them in for repairs.