Significant security vulnerabilities have been revealed in Volkswagen's connected car app, leading to a breach and exposure of sensitive personal information and complete vehicle maintenance histories worldwide.
See also: Volkswagen hacking: 19,000 documents stolen from server
These flaws allowed unauthorized access to user data through simple exploitation techniques, requiring only the vehicle identification number (VIN), which is visible through most windshields.
This incident is the second major cybersecurity breach for Volkswagen in six months, following a December 2024 data leak from cloud storage that affected 800,000 electric vehicles .
Cybersecurity researcher Vishal Bhaskar discovered the vulnerabilities after he bought a used Volkswagen in 2024. While trying to connect the vehicle to the My Volkswagen, he encountered a problem: the one-time password (OTP) was sent to the previous owner's phone.
Rather than accept failure, Bhaskar noticed that the app had no lockout mechanism after multiple failed login attempts. An automated script eventually managed to crack the password – but that was just the beginning. Bhaskar identified three critical vulnerabilities in Volkswagen’s systems :
See also: Vulnerabilities in Skoda cars allow hackers to track their location
Internal Credential Leak: An API endpoint exposed internal usernames, passwords, tokens, and even login details for third-party services, such as payment providers and Salesforce – all in plain, unencrypted text.
Personal Information Exposure via VIN: Another endpoint exposed customer profiles that included names, phone numbers, email addresses, mailing addresses, and registration information, all linked to maintenance histories – accessible simply by using the vehicle's VIN.
Full Maintenance History Accessible: A third vulnerability allowed access to full maintenance histories, customer complaints, and even satisfaction survey results – for any vehicle, simply by entering the corresponding VIN.
Bhaskar reported the vulnerabilities to Volkswagen on November 23, 2024.After several months of communication, Volkswagen confirmed on May 6, 2025 that all vulnerabilities had been patched. As vehicles become increasingly connected to the internet, cybersecurity researchers warn that manufacturers must prioritize the security of their systems to prevent unauthorized access to the increasing amount of personal data that modern cars collect.
See also: Uber and Volkswagen collaborate on robotaxi service in the US
Based on the above, it is clear that the rapid development of “smart” and connected vehicles is accompanied by significant cybersecurity risks .As automakers integrate more and more digital services — such as vehicle management applications, remote control, cloud-based data and telematics — new “windows” are opening that can be exploited by malicious users.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
