GitGuardian published an article with details on the Toyota data breach. A subcontractor had published a portion of the T-Connect source code on Github. The repo included a hardcoded access key. Toyota’s own disclosure (in Japanese) dates the upload to December 2017 and says the key opened a data server holding the email addresses and customer management numbers of 296,019 T-Connect users. Toyota made the code private on September 15, 2022, changed the key two days later, and could not completely rule out third-party access. Finding the key took five years, rotating it took two days.
Toyota T-Connect access key sat on GitHub for five years
··1 min