Data associated with approximately 800,000 connected electric vehicles from Volkswagen, Audi, SEAT and Škoda was exposed online in late 2024. The incident involved location, movement, charging and vehicle-identification data stored in Volkswagen Group software subsidiary CARIAD’s Amazon cloud infrastructure. Around 460,000 vehicles reportedly had especially precise location records.
This was a serious privacy and cloud-security exposure, but the available evidence does not show that criminals remotely took control of the cars. Volkswagen said the misconfiguration was fixed, that passwords and payment data were not involved, and that it found no evidence of misuse beyond the investigation by the Chaos Computer Club (CCC).
What happened?
CARIAD, Volkswagen Group’s software subsidiary, stored connected-vehicle information in Amazon cloud infrastructure. According to reporting by BleepingComputer, ADAC, Der Spiegel and the CCC, a configuration error left parts of that data insufficiently protected for months.
A whistleblower alerted the CCC and Der Spiegel. CCC researchers investigated the exposure and reported that some records could be linked to individuals. The researchers notified CARIAD on November 26, 2024. Volkswagen subsequently said the vulnerability had been closed, and the findings became public in late December 2024, including through the CCC’s 38C3 congress presentation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- ✅ 𝟐𝟎𝟐𝟔 𝐄𝐧𝐡𝐚𝐧𝐜𝐞𝐝 𝐎𝐁𝐃𝟐 + 𝐂𝐀𝐍 𝐃𝐢𝐚𝐠𝐧𝐨𝐬𝐭𝐢𝐜 𝐒𝐜𝐚𝐧 𝐓𝐨𝐨𝐥 】: The V519 is a powerful 2026-upgraded scanner supporting both OBD2 and CAN protocols with full access to all 10 OBDII modes. Go beyond basic code reading with advanced Mode 6 (component-level monitoring) and Mode 8 (active tests) — allowing you to uncover hidden issues like misfires, EVAP leaks, or O2 sensor failures. This complete diagnostics suite gives you the same capabilities trusted by professionals to accurately analyze engine health in 1996 and newer vehicles.
- 📊【𝐋𝐢𝐯𝐞 𝐃𝐚𝐭𝐚 𝐒𝐭𝐫𝐞𝐚𝐦𝐢𝐧𝐠 + 𝐅𝐫𝐞𝐞𝐳𝐞 𝐅𝐫𝐚𝐦𝐞 + 𝐃𝐚𝐭𝐚 𝐏𝐥𝐚𝐲𝐛𝐚𝐜𝐤】: Monitor your vehicle’s health in real-time with graph-based live data, including O2 sensor voltages and fuel trims. Capture freeze frame snapshots at the moment faults occur and replay recorded diagnostic sessions to pinpoint intermittent issues and validate repairs on the spot.
- 🔋【𝐁𝐚𝐭𝐭𝐞𝐫𝐲 𝐕𝐨𝐥𝐭𝐚𝐠𝐞 𝐌𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠 + 𝐈/𝐌 𝐑𝐞𝐚𝐝𝐢𝐧𝐞𝐬𝐬】: Conduct precision battery diagnostics with built-in voltage monitoring that shows both pre-crank (identify weak batteries) and post-start charging status (detect alternator issues). Clear pass/fail thresholds help prevent unexpected breakdowns. The I/M Readiness check ensures your emissions system is fully operational before a smog test — no more last-minute inspection failures.
- 📘【𝐃𝐓𝐂 𝐂𝐨𝐝𝐞 𝐋𝐢𝐛𝐫𝐚𝐫𝐲 (𝟒𝟎,𝟎𝟎𝟎+) + 𝐌𝐮𝐥𝐭𝐢-𝐋𝐚𝐧𝐠𝐮𝐚𝐠𝐞 𝐒𝐮𝐩𝐩𝐨𝐫𝐭】: Instantly access over 40,000 diagnostic trouble codes (including P0, P2, U0-series) with on-screen definitions — no internet required. Capture freeze frame data to analyze fault conditions as they occurred, helping you diagnose intermittent issues like random misfires or abnormal fuel trims. With 10 supported languages, the V519 is ideal for mechanics and DIYers around the world.
- 📋【𝐒𝐦𝐨𝐠 𝐓𝐞𝐬𝐭 𝐏𝐚𝐬𝐬 𝐆𝐮𝐚𝐫𝐚𝐧𝐭𝐞𝐞】: Quickly check I/M readiness across 11 key emissions monitors including CAT, EVAP, and EGR. Reset monitors after repairs and confirm your vehicle meets state smog standards. Ideal for pre-inspection checks to avoid unexpected test failures.
The incident involved connected electric vehicles in Europe, with Germany prominently represented. The available evidence does not establish that all Volkswagen Group EVs worldwide—or vehicles in the United States—were included.
Which brands and how many vehicles were involved?
Reports identified data associated with four Volkswagen Group brands:
- Volkswagen
- Audi
- SEAT
- Škoda
The commonly reported figures require careful interpretation:
| Figure | What it means |
|---|---|
| About 800,000 | Electric vehicles represented in the exposed data |
| About 460,000 | Vehicles reportedly associated with particularly precise location information |
“800,000 cars” does not necessarily mean 800,000 uniquely identifiable owners. A dataset can contain multiple records for one vehicle, pseudonymous records, changing drivers or vehicles that could not be linked to a named person. The number of people who were identifiable, and the number who suffered harm, has not been established by the available reporting.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- 🔋【APPLICABLE MODELS】OBD2 Code Reader for Volkswagen ID.Buzz EV 2025–Present. Please carefully confirm whether this product is suitable for your Model.
- 🚗【READ & ERASE FAULT CODES FOR DAILY VEHICLE CHECKS】 This OBD2 scanner helps read diagnostic trouble codes and clear certain stored codes after inspection. When the Check Engine Light appears, it provides code information to help drivers understand vehicle status. Designed for everyday use, this car diagnostic tool offers a convenient way to check basic vehicle information before maintenance or service.
- 📊【LIVE DATA STREAM WITH CLEAR COLOR DISPLAY】View real-time vehicle information through the live data stream function and monitor important data during diagnostic checks. The clear color screen provides easy-to-read menus, codes, and vehicle information, allowing users to navigate functions more conveniently. The handheld design makes this OBD2 code reader suitable for DIY users, personal vehicles, and routine vehicle inspections.
- 🔧【MULTIPLE DIAGNOSTIC FUNCTIONS FOR VEHICLE CARE】Designed with practical OBD2 functions including fault code reading, code clearing, I/M readiness checking, live data viewing, and voltage testing. This automotive diagnostic tool helps drivers check basic vehicle information and prepare for routine maintenance needs. A useful tool for home garages, daily driving, and vehicle owners who want a simple way to access diagnostic data.
- 🏠【EASY-TO-USE HANDHELD OBD2 SCANNER】No complicated setup or additional equipment is required. Simply connect the scanner to your vehicle’s OBD2 port and follow the on-screen instructions to begin checking diagnostic information. Its compact handheld design allows convenient storage in a toolbox, garage, or vehicle, making it suitable for everyday drivers, and routine vehicle inspection needs.
What information was exposed?
Reported data categories included:
- Vehicle location and movement information
- Timestamps and the duration of stops
- Battery and charging information
- Vehicle identifiers and pseudonymous identifiers
- In some records, email addresses, telephone numbers or addresses
- Vehicle activation or deactivation information, according to a European Parliament document summarizing the reports
Volkswagen said that passwords and payment information were not affected. That is the company’s statement, rather than an independently audited conclusion established by the sources available here. The exposure should not be described as a payment-card or password breach.
How precise was the location data?
Precision varied across the records. Reporting indicates that some data was detailed enough to reconstruct vehicle movements, while information associated with approximately 460,000 vehicles was reportedly precise enough to support highly specific location analysis. The CCC presentation and secondary reports described some Volkswagen and SEAT data as accurate to roughly 10 centimeters; that figure should not be generalized to every record or brand.
Location data does not need centimeter-level accuracy to be sensitive. Repeated journeys can reveal a vehicle’s home and workplace, regular medical visits, religious or political affiliations, relationships and visits to police, military or government facilities.
Could the records identify people?
Yes, in some cases, according to the reported investigation. Volkswagen described the information as pseudonymized. Pseudonymization replaces direct identifiers with codes, but it does not make data permanently anonymous: another dataset, account detail or key may allow the records to be connected to a person.
Recommended Free Tools
Rank #3
- 🔋【APPLICABLE MODELS】OBD2 Code Reader for Volkswagen ID.4 EV 2021–Present. Please carefully confirm whether this product is suitable for your Model.
- 🚗【READ & ERASE FAULT CODES FOR DAILY VEHICLE CHECKS】 This OBD2 scanner helps read diagnostic trouble codes and clear certain stored codes after inspection. When the Check Engine Light appears, it provides code information to help drivers understand vehicle status. Designed for everyday use, this car diagnostic tool offers a convenient way to check basic vehicle information before maintenance or service.
- 📊【LIVE DATA STREAM WITH CLEAR COLOR DISPLAY】View real-time vehicle information through the live data stream function and monitor important data during diagnostic checks. The clear color screen provides easy-to-read menus, codes, and vehicle information, allowing users to navigate functions more conveniently. The handheld design makes this OBD2 code reader suitable for DIY users, personal vehicles, and routine vehicle inspections.
- 🔧【MULTIPLE DIAGNOSTIC FUNCTIONS FOR VEHICLE CARE】Designed with practical OBD2 functions including fault code reading, code clearing, I/M readiness checking, live data viewing, and voltage testing. This automotive diagnostic tool helps drivers check basic vehicle information and prepare for routine maintenance needs. A useful tool for home garages, daily driving, and vehicle owners who want a simple way to access diagnostic data.
- 🏠【EASY-TO-USE HANDHELD OBD2 SCANNER】No complicated setup or additional equipment is required. Simply connect the scanner to your vehicle’s OBD2 port and follow the on-screen instructions to begin checking diagnostic information. Its compact handheld design allows convenient storage in a toolbox, garage, or vehicle, making it suitable for everyday drivers, and routine vehicle inspection needs.
CCC and Der Spiegel reportedly demonstrated that vehicle records could be correlated with other information, including contact details, to identify drivers in some cases. A long-term location trail can also be identifying by itself. Someone who knows where a vehicle repeatedly spends the night may be able to infer the owner’s identity without a name appearing in the database.
Was this a confirmed data breach?
It was a confirmed data exposure and security vulnerability. The records were reportedly accessible online, and CCC researchers accessed and analyzed them after receiving information from a whistleblower.
That is different from proving that criminals downloaded, sold or broadly exploited the data. No such criminal misuse was reported in the available sources. Volkswagen said it had no indication of misuse by third parties beyond the CCC’s investigation. That assurance cannot prove that nobody else viewed or copied records, so the most accurate wording is that no confirmed wider misuse has been reported.
Were the cars themselves hacked?
There is no evidence in the available reporting that attackers could remotely unlock, start, stop, steer or take over the vehicles. The incident concerned data in backend cloud systems, not a demonstrated vulnerability in vehicle controls.
Rank #4
- 𝙃𝙤𝙬 𝙢𝙖𝙣𝙮 𝙢𝙖𝙞𝙣𝙩𝙚𝙣𝙖𝙣𝙘𝙚 𝙧𝙚𝙨𝙚𝙩 𝙛𝙪𝙣𝙘𝙩𝙞𝙤𝙣𝙨 𝙙𝙤𝙚𝙨 𝙞𝙩 𝙝𝙖𝙫𝙚? --It is upgraded to15 professional reset services (up from traditional 9 types), covering ABS Bleeding, AdBlue Reset, Airbag Reset, Battery Matching, Brake Pad Reset, D.P.F Regeneration, Throttle Adaption, Gearbox Learning, Injector Coding, Oil Reset, Steering Angle Reset and TPMS Reset. It meets most daily car maintenance needs. Tip: Please confirm vehicle compatibility before purchase.
- 𝙒𝙝𝙖𝙩 𝙘𝙤𝙧𝙚 𝙫𝙚𝙝𝙞𝙘𝙡𝙚 𝙨𝙮𝙨𝙩𝙚𝙢𝙨 𝙘𝙖𝙣 𝙞𝙩 𝙙𝙚𝙩𝙚𝙘𝙩? --It fully supports detection for Engine, ABS, SRS and Transmission systems. You can read & erase fault codes, and view real-time data including engine temperature, wheel speed, transmission temperature and more. It is more cost-effective and convenient than offline repair services, plus lifetime updates are included.
- 𝙒𝙝𝙖𝙩 𝙖𝙗𝙤𝙪𝙩 𝙞𝙩𝙨 𝙝𝙖𝙧𝙙𝙬𝙖𝙧𝙚 𝙘𝙤𝙣𝙛𝙞𝙜𝙪𝙧𝙖𝙩𝙞𝙤𝙣 𝙖𝙣𝙙 𝙥𝙧𝙖𝙘𝙩𝙞𝙘𝙖𝙡 𝙛𝙚𝙖𝙩𝙪𝙧𝙚𝙨? --Built with 1.8GHz processor, Android 8.1 system, 6.2-inch 1024*600 touch screen and 32GB built-in storage (expandable to 128GB via TF card). It supports one-click WiFi update, automatic VIN recognition (no manual input), DTC reading & clearing, real-time data monitoring, actuator test and remote assistance. A new protective film is also equipped for better device protection.
- 𝘾𝙖𝙣 𝙄 𝙜𝙚𝙣𝙚𝙧𝙖𝙩𝙚 𝙞𝙣𝙩𝙚𝙡𝙡𝙞𝙜𝙚𝙣𝙩 𝙙𝙞𝙖𝙜𝙣𝙤𝙨𝙩𝙞𝙘 𝙧𝙚𝙥𝙤𝙧𝙩𝙨 𝙖𝙣𝙙 𝙘𝙤𝙣𝙣𝙚𝙘𝙩 𝙩𝙤 𝙖 𝙘𝙤𝙢𝙥𝙪𝙩𝙚𝙧 𝙛𝙤𝙧 𝙥𝙧𝙞𝙣𝙩𝙞𝙣𝙜? --Equipped with the exclusive MUAI intelligent analysis system, the scanner provides instant fault cause analysis and professional repair suggestions after clicking any DTC, and supports generating standard intelligent diagnostic reports. You can connect the scanner to a computer to easily export and print complete diagnostic reports. Requirement: The device must connect to the internet and run the latest firmware.
- 𝙄𝙨 𝙩𝙝𝙞𝙨 𝙖 𝙜𝙡𝙤𝙗𝙖𝙡 𝙫𝙚𝙧𝙨𝙞𝙤𝙣? 𝘾𝙖𝙣 𝙄 𝙪𝙨𝙚 𝙞𝙩 𝙣𝙤𝙧𝙢𝙖𝙡𝙡𝙮 𝙖𝙗𝙧𝙤𝙖𝙙 𝙬𝙞𝙩𝙝𝙤𝙪𝙩 𝙧𝙚𝙜𝙞𝙤𝙣𝙖𝙡 𝙧𝙚𝙨𝙩𝙧𝙞𝙘𝙩𝙞𝙤𝙣𝙨? --It is a full global version with no regional locks or usage restrictions. You can use it normally in any country and region worldwide. It supports all vehicles built after 1996, covering 150+ mainstream brands and over 10,000 vehicle models. Equipped with 28 multi-language options including English, French, German, Spanish, Portuguese, Japanese, Russian, Korean and Traditional Chinese to fit global usage scenarios.
The available sources also do not establish access to in-car microphones or cameras, charging-system manipulation or remote driving. A cloud privacy exposure and a remote vehicle-control hack are separate threat categories.
What Volkswagen and CARIAD said
Volkswagen characterized the problem as a misconfiguration and said it was fixed after notification. The company said the access process was technically complex and multi-stage, that there was no evidence of misuse beyond the CCC’s testing, and that passwords and payment data were not involved.
Volkswagen also said the information was collected to improve batteries, charging and related software. CARIAD’s role is consistent with its position within Volkswagen Group: the group’s 2024 annual report describes CARIAD as responsible for cross-brand software governance involving data, backend and cloud systems.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What affected owners should do
The company’s statement does not make an emergency password reset mandatory. Owners should nevertheless take proportionate account-security precautions:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Best Value
- ⚠️【Important Tips Before Purchcase】1. Compatible with standard OBD II vehicles from 1996 onward in the US market. ⚠️2. Due to the Safe Gateway (SGW) / FCA AutoAuth security system, this tool cannot access OBDII modules to clear codes for FCA vehicles (including Chrysler, Dodge, Jeep, etc.) manufactured after 2017. ⚠️And vehicle brands equipped with a SGW are not supported either. ⚠️3. Not support TPMS or other service functions. Only the basic OBDII code reader. Functions not universal, please s-end mes-sage via Ama-zon or 📞autelofficial @ outlook . com📞 to check before order.
- 🧡【How to get a PDF User Manual ?】a) Download directly via Am-azon page from Product guides and documents section. b) Mes-sage us directly via Am-azon or 📞autelofficial @ outlook . com📞, we will send you the PDF version within 0-24 hours. ⚠️📢Warm Tips: 1. It does not support the full engine system, or more advanced prameter display, if need, please consider autel MD906 PRO/ MK808BT PRO etc. 2. Autel MS309 does not listed in Autel US distributor's w-eb. It is only listed in Autel HQ w-eb. If need, please con-tact us to get w-eb.
- 🧡【How to Use The Tool?】The MS309 autel scanner is a plug-and-play tool; it does not require registration. Step 1: With the k~ in the ON position, the engine off. 2. Connect the MS309 OBDII cable to the vehicle's OBDII port. 3. Then, select the on-screen menu to perform the function. 📢Note: Autel MS309 comes with standard OBD II plug, please ensure your vehicle's port is a stardard OBDII (16 Pin) and not loose.
- 🔥【On-Screen DTC Definition, Save Time & Easy To Use】Autel MS309 OBD2 code reader for cars and trucks can retrive and clear generic(P0, P2, P3 and U0), manufacturer-specific(P1, P3 and U1) and pending codes, and display DTCs(Diagnostic Trouble Codes) meanings under the codes based on the built-in database(1000+ codes). Don't need to spend much time to search meanings on the internet. This advanced plug-and-play MS309 scanner saves you time - a must-have obd2 scanner for each DIY car owner.
- 🔥【Retrieve Freeze Frame Data & Vehicle info】The OBD2 scanner MS309 can retrieve freeze frame data, Vehicle Information such as VIN number, Calibration ID(s), Calibration Verification Nos. (CVNs), etc, which is useful to check whether the ECU matches when you are buying a used car.
- Check the official Volkswagen, Audi, SEAT or Škoda app and account for unfamiliar logins, account changes or vehicle activity.
- Use a unique password for the vehicle account, particularly if its old password was reused elsewhere.
- Enable multifactor authentication where the relevant service supports it.
- Secure the email account connected to the vehicle account, since email access can enable password resets.
- Be suspicious of messages mentioning a VIN, battery, charging account, service appointment or vehicle location.
- Never provide one-time codes or remote-access permission to an unsolicited caller claiming to represent the manufacturer.
- Contact the brand through its official website or app if you see unusual account activity or vehicle commands.
- Ask the manufacturer which data categories, country records and retention periods apply to your account.
There is no evidence in this incident that owners need to replace their vehicles, delete the app or disable all connectivity. Those steps would not necessarily erase data already collected, and the reported cloud vulnerability was said to have been closed.
What privacy-conscious car buyers should ask
The incident raises a broader question: how much detailed information should a connected car collect, and for how long? Before buying or activating a connected vehicle, ask:
- Is precise location collected continuously or only during specific functions?
- How long are location, charging and driving records retained?
- Are records tied to the vehicle, VIN, account, phone number or owner?
- Can nonessential collection be refused without losing safety functions?
- Which vendors and cloud providers process the data?
- Is the information encrypted at rest and in transit?
- Can owners access or delete their data?
- Is data shared with insurers, advertisers, dealers or analytics providers?
- What happens to the account and historical data when a car is sold or leased?
- Are former drivers removed from connected services?
- Does the account support multifactor authentication and session controls?
What remains unknown
The available reporting does not establish the exact exposure window, the exact number of identifiable owners, whether anyone besides the CCC accessed or retained the data, or which precise models and European jurisdictions were included. It also does not independently verify Volkswagen’s statements about misuse, passwords or payment information.
The larger lesson is that fixing a cloud configuration is only one part of connected-car privacy. Location histories can remain sensitive even when pseudonymized, and correcting access controls does not automatically answer how much data was collected, how long it was retained or whether owners had meaningful control over it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
