Japanese auto giant Toyota Motor Corporation has confirmed yet another third-party data breach exposing sensitive information, after a threat actor leaked the stolen trove on an infamous dark web hacking forum.
The cyber incident became public knowledge when ZeroSevenGroup claimed to have breached a Toyota U.S. branch and posted 240 GB of the allegedly stolen data BreachForums.
“We have hacked a branch in [the] United States to one of the biggest automotive manufacturer[s] in the world (TOYOTA). We are really glad to share the files with you here for free. The data size: 240 GB,” the threat actor said.
However, Toyota disputes the facts regarding the alleged North American cyber intrusion and shifted responsibility to a third-party vendor.
Toyota: hacker misrepresented third-party data breach
The miscreant claims the database contains employee and customer data, financial information, and technical network infrastructure details, which could expose the affected vendor to more cyber attacks.
“Contents: Everything like Contacts, Finance, Customers, Schemes, Employees, Photos, DBs, Network infrastructure, Emails, and a lot of perfect data,” ZeroSevenGroup claimed. “We also offer you AD-Recon for all the target network[s] with passwords.”
However, Toyota’s spokesperson stated that the third-party data breach did not affect the company’s systems, adding that the hacked vendor was erroneously “misrepresented as Toyota.”
“Toyota Motor North America was not the subject of this activity. Contrary to what has been reported, our systems were not breached or compromised.” The automaker also added that the third-party data breach was limited in scope and that it had engaged impacted individuals to offer necessary assistance.
While Toyota could understandably shift responsibility for the third-party data breach, it hardly alleviates the risk that the impacted individuals face, or relieves the automaker of the obligation to clean the mess. In addition, the task of vetting vendors rests solely with the primary organization, for which failure the company should take full responsibility.
Meanwhile, information regarding the breached vendor, the nature of the stolen information, when and how the threat actor gained access, and the number of victims, was not immediately available. Toyota also remained tight-lipped on whether the threat actor had demanded a ransom before leaking the stolen data for free on the BreachForums hacking forum.
According to Guido Grillenmeier, Principal Technologist at Semperis, Toyota’s third-party data breach demonstrates that large corporations “oftentimes have the biggest targets on their backs.”
“It doesn’t surprise me that the attackers breached one of Toyota’s U.S. dealerships given how vast their footprint is with more than 1,500 locations in the U.S. and 200 global distributors,” Grillenmeier said.
Grillenmeier urged organizations to build “operational resiliency” but warned that “there’s no silver bullet that will solve the cybersecurity challenges facing organizations.”
Yet another Toyota data breach
The Toyota third-party data breach is the latest in a series of cybersecurity incidents that have plagued the top Japanese automaker in the last half-decade.
In November 2023, Toyota Financial Services suffered a ransomware attack that leaked sensitive information, including staff email and financial data. The resurgent Medusa ransomware gang claimed responsibility for the TFS cyber attack and demanded $8 million in ransom.
In May 2023, Toyota also discovered a decade-old data breach stemming from a misconfigured cloud that affected over 2 million customers.
Similarly, security researcher Eaton Zveare innocuously breached Toyota’s Global Supplier Preparation Information Management System (“GSPIMS”) in February 2023. Toyota employees and suppliers use the web app to coordinate the automaker’s supply chain tasks and projects.
In October 2022, Toyota also exposed 300,000 customers after leaving access keys exposed on GitHub. In March of the same year, Toyota halted production when a cyber attack struck Kojima Industries. The company also suffered a third-party breach impacting Denso Corp., Toyota’s subsidiary and supplier, leaking 1.4 terabytes of data.
Much earlier in 2019, Toyota Motor North America confirmed a data breach that exposed up to 3.1 million customer records.
