Honda India has reportedly allowed personal data of over 50,000 online users become publicly accessible.
A Kromtech Security report suggests two ‘Amazon S3 buckets’ – a unit metadata of storage – were containing information of people who had installed the Honda Connect app on their smartphone.
The app, developed by Honda Car India, uses remote vehicle management and enables Honda owners to interact with their car.
Honda Connect also holds customers’ personal and vehicle information, including names and gender, email addresses, phone numbers, vehicle VIN codes and account passwords.
Kromtech.com reports another “security researcher”, named @Random_Robbie on Twitter, “left them the following note” in their system; “Please secure your s3 bucket before a bad guy finds it!!”.
The Kromtech.com report says with the leaked information, someone could find the vehicle and phone owner’s current location, where they have been, where they typically drive and stop including workplaces or their home.
“It shows that many companies of all sizes are not paying any attention to their security,” the report says of the bucket which remained unsecured for three months.
“Honda Car India didn’t even notice that a security researcher added a note to their buckets. There is no excuse for that, it clearly illustrates that they are simply running on auto-pilot with no monitoring at all.
Kromtech says even sending malicious text messages or emails from known and trusted contacts on a user’s phone or contact list is possible.
Kromtech says it has notified Honda Cars India of the issue who have since secured the data buckets.
A Honda Australia spokesperson tells AutoTalk the Indian subsidiary is looking into the report.
“Honda India is investigating this issue with their cyber security partner from all perspectives and as per their initial investigation, it appears that most data is intact and has not leaked.”
Join the conversation