• Car manufacturers particularly avaricious in data collection.
• Details of 800,000 vehicles exposed unprotected on AWS for several months.
• Over half of the vehicles provided detailed location histories.

A report in German magazine Der Spiegel [German language] has revealed that highly personal data about 800,000 vehicle drivers was left unprotected and easily-accessible from car makers VW, Seat, Audi, and Skoda. The exposed data included names, emails, vehicle identification information, and detailed location data for around 460,000 vehicles, including police cars and those of business leaders and politicians in Europe.

The data was left largely unprotected and un-encrypted on AWS by VW subsidiary, Cariad. Investigators at Der Spiegel and the Chaos Computer Club (CCC) found that browsing parts of the Cariad corporate website exposed directory listings which allowed access to the data collection using little more than simple tools, including a web browser.

The gym, the shops, wherever you visit

Geo-positioning data, accurate in some cases down to ten centimetres, showed where cars had travelled over the course of 2024, including where they’d been parked and which charging stations had been used. For politician Nadja Weippert, who sits in the Lower Saxony state parliament and is the mayor of Tostedt, the news of the data’s open availability was particularly alarming; she is the data protection spokesperson of the Green group for the area, and a newly less-keen BMW ID.3 owner.

“I’m shocked,” Weippert said, “[…] My data is stored un-encrypted in the Amazon cloud and even then not adequately protected. i expect VW to stop collecting data, [or] collect less data and at least anonymise it.”

Some cars provided richer data collection than others, investigative researchers at Der Spiegel and the CCC found. The VW models ID.3 and ID.4 both require their owners to use a smartphone app to get access to all the features of the vehicle, and once phone and vehicle data is correlated in software, rich information is fed to the manufacturer and its subsidiary Cariad.

Car makers’ record on data collection

The Mozilla Foundation dedicated an entirely separate addendum on automobile manufacturers’ practices when it compiled its ‘Privacy Not Included‘ report, noting that 86% of car makers bundle their customers’ collected data and sell it to data brokers, although it’s claimed by the industry that such information is anonymised. But as even trainee data specialists will attest, de-anonymising data by simple cross-referencing it with other sources turns ‘safely anonymised’ information into personally-identifiable description of individuals, preferences, and habits.

The potential for criminal or terrorist attack is an obvious concern when data is left unprotected by error or ‘misconfiguration’ (the term used by Cariad to explain the cause of the problem described to them by the researchers). But the underlying issue remains: many organisations collect personal user data for commercial gain, and couch their intention to do so in legalese, buried in rarely-read Terms and Conditions.

The only difference between a bad actor stumbling on an unprotected trove of sensitive information and anyone accessing personally-identifiable data legally is that in the latter scenario, money changes hands in the largely unregulated market for consumer and commercial data. Car manufacturers are no worse or better than those making and selling smart home or office appliances, phones, computer operating systems, or any number of other desired necessities of life in 2025.