Incident: A key in the source, public for nearly five years

Module 1 · Incident file · About 35 minutes

What happened

On 7 October 2022 Toyota Motor Corporation published a notice titled, in translation, "Apology and notice regarding the possible leak of customer email addresses and other data". It concerns T-Connect, the company's connected-car service. The notice says that in December 2017 the contractor developing the T-Connect website uploaded part of its source code to a GitHub account that was mistakenly set to public, and that "the published source code contained an access key to the data server". With that key it was possible to read the server's contents. Toyota confirmed the exposure on 15 September 2022; on 17 September it changed the data server's access key.

The notice puts the possible exposure at 296,019 records: email addresses and the customer management numbers used to run the service. Names, phone numbers and card details were not on that server and were not at risk. Simon Sharwood's report for The Register (11 October 2022) adds that Toyota "was unable to confirm or deny" whether anyone had used the key (the notice itself says no misuse had been confirmed at the time of writing), and that customers were told to scrutinise incoming email for phishing. The key had sat in a public repository for four years and nine months. Nobody had rotated it, because nobody knew it had left the building.