Toyota has confirmed yet another breach, this time with a massive 240 GB archive of data leaked on a hacking forum by ZeroSevenGroup. The automaker, a global leader in the automotive industry, acknowledged the breach following the leak, which allegedly originated from one of its U.S. branches.
The breach was first reported after the threat actor claimed responsibility for the attack. The group announced on a hacking forum that they had successfully infiltrated Toyota’s systems and exfiltrated sensitive information, including employee and customer data, contracts, financial records, and network infrastructure details.
This latest incident marks another entry in a growing list of cybersecurity breaches involving Toyota. Although the company insisted that the breach is limited in scope and does not affect its systems globally, the exact extent of the damage remains unclear.
Toyota has refrained from providing detailed information on how the breach occurred, when it was detected, or the total number of individuals whose data may have been compromised.
“We are aware of the situation. The issue is limited in scope and is not a system-wide issue,” Toyota told BleepingComputer.
However, many questions remain unanswered, particularly concerning the timeline of the breach and the measures Toyota has taken since the data was stolen.
The stolen data is believed to have been gathered using ADRecon, an open-source tool to extract detailed information from Active Directory environments. This raises concerns about the security of Toyota’s network infrastructure, especially because the threat actor claimed to have accessed comprehensive network credentials.
This breach adds to Toyota’s troubling pattern of cybersecurity issues. In May 2023, Toyota’s misconfigured cloud bucket was exposed to unauthorized access to the Internet, exposing the data of more than 2.15 million customers in Japan.
This and subsequent breaches prompted Toyota to implement an automated monitoring system to secure cloud configurations and database settings. However, the recurrence of breaches suggests that these measures may be insufficient to protect against increasingly sophisticated cyber threats.
In the News: Recordscheck.net hosted sensitive NPD information in plain text
