The Tesla Motors Inc. Model X SUV was involved in an accident in the U.S. and was later discovered to be online in Ukraine, sending notifications to its former owner, Jay Yarow. The new owners in Ukraine were even using Yarow’s Spotify app to listen to music. This raised concerns about the security risk of restored totaled cars. According to Ken Tindell, CTO of automotive security firm Canis Labs, the credentials to internet services are often left in the vehicle electronics and can be accessed by anyone. This issue is not exclusive to Tesla cars; it applies to all internet-connected devices. It is important for dealers and owners to understand the risk of private data within the vehicle.
The Tesla ended up in Ukraine after being listed for sale on the online auction site Copart, which specializes in salvage vehicles. These vehicles, which cannot legally be driven on U.S. roads, are often shipped overseas. The practice of selling totaled cars in secondary markets and shipping them overseas has been ongoing for years and has been facilitated by digital auctions.
To address the security issue, Tesla support staff advised Yarow to disconnect his car from his account. This would prevent others from accessing previously connected apps, but data can still be extracted from the car’s electronics. Expert opinions suggest that Tesla should have a portal where users can remotely wipe their data and disconnect their vehicle from their account. In the meantime, owners should be cautious about sharing personal information with their vehicles and should purge data after using rental cars.