Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe short version: In November 2024, security researchers Sam Curry and Shubham Shah discovered vulnerabilities in a Subaru employee-facing web portal connected to the company’s STARLINK telematics system. The flaws could have allowed an attacker who took over an employee account to find vehicles, unlock doors, activate the horn, remotely start the engine, change account access, and retrieve detailed location history.
The potential exposure involved millions of STARLINK-equipped Subarus in the United States, Canada, and Japan—not millions of confirmed hacked vehicles. Subaru said it patched the reported vulnerability immediately or within 24 hours, and there is no public evidence in the cited reporting of mass criminal exploitation.
As an Amazon Associate I earn from qualifying purchases.
What researchers found
Curry began examining the connected features of a 2023 Subaru Impreza owned by his mother. He and Shah noticed that Subaru’s consumer connected-services system interacted with an administrative domain used by employees. Their investigation found several weaknesses working together, rather than one isolated defect.
The reported chain included a weak employee-account password-reset process, security-question checks that could be bypassed on the client side, insufficient separation between employee privileges and customer vehicle controls, broad customer-search functions, and the ability to add or reassign authorized users without an obvious notification to the existing owner.
#1 Best Overall
- CEL Doctor: The ANCEL AD310 is one of the best-selling OBD II scanners on the market and is recommended by Scotty Kilmer, a YouTuber and auto mechanic. It can easily determine the cause of the check engine light coming on. After repairing the vehicle's problems, it can quickly read and clear diagnostic trouble codes of emission system, read live data & hard memory data, view freeze frame, I/M monitor readiness and collect vehicle information
- Sturdy and Compact: Equipped with a 2.5 foot cable made of very thick, flexible insulation. It is important to have a sturdy scanner as it can easily fall to the ground when working in a car. The AD310 OBD2 scanner is a well-constructed mechanic tool with a sleek design. It weighs 12 ounces and measures 8.9 x 6.9 x 1.4 inches. Thanks to its compact design and light weight, transporting the device is not a problem. The buttons are clearly labelled and the screen is large and displays results clearly
- Accurate Fast and Easy to Use: The AD310 scanner can help you or your mechanic understand if your car is in good condition, provides exceptionally accurate and fast results, reads and clears engine trouble emission codes in seconds after you fixed the problem. This device will let you know immediately and fix the problem right away without any car knowledge. No need for batteries or a charger, get power directly from the OBDII Data Link Connector in your vehicle
- OBDII Protocols and Car Compatibility: Many cheap scan tools do not really support all OBD2 protocols. AD310 scanner as it can support all OBDII protocols such as KWP2000, J1850 VPW, ISO9141, J1850 PWM and CAN. This device also has extensive vehicle compatibility with 1996 US-based, 2000 EU-based and Asian cars, light trucks, SUVs, as well as newer OBD2 and CAN vehicles both domestic and foreign. Pls confirm with our customer service whether it is compatible with your vehicle before purchasing
- Home Necessity and Worthy to Own: This is an excellent code reader to travel or home with as it weighs less and it is compact in design. You can easily slide it in your backpack as you head to the garage, or put it on the dashboard, this will be a great fit for you. The AD310 is not only portable, but also accurate and fast in performance. Moreover, it covers various car brands and is suitable for people who just need a code reader to check their car
The affected system was Subaru’s STARLINK connected-vehicle service—not SpaceX’s Starlink satellite-internet service. Subaru now presents many of these functions through MySubaru Connected Services.
What an attacker could do
According to the researchers’ report, a compromised employee account could be used to search for customers or vehicles using identifiers such as:
- Last name and ZIP code
- Email address
- Phone number
- License plate
After locating a vehicle, the researchers said the account could expose or modify connected-service settings and authorized-user relationships. Demonstrated functions included:
- Remote door unlocking and locking
- Activating the horn
- Remote engine start
- Looking up the vehicle’s location
- Adding or transferring an authorized user
The vehicle-control tests were performed on vehicles whose owners had authorized the research, according to Subaru’s statement and the published coverage. The researchers did not publish evidence that they used the flaw to stalk an unwilling victim.
The biggest privacy risk was historical location data
The most serious consequence may not have been remote unlocking. The researchers reported that Subaru’s internal tools exposed at least a year of detailed vehicle-location history in their test case, sometimes with multiple precise location points per day.
A single live location is sensitive. A year of repeated locations can reveal where someone lives and works, which doctors or medical facilities they visit, religious attendance, relationships, routines, and when a home may be empty. That information could be useful for stalking, domestic abuse, burglary planning, workplace surveillance, or harassment.
Rank #2
- 【Diagnose Check Engine Light in Seconds – No Mechanic Needed】The FOXWELL NT301 OBD2 scanner instantly reads & clears engine fault codes (DTCs) with one click. Simply plug into the 16-pin DLC port, turn ignition on, and get accurate results within seconds—No prior car knowledge required. Save hundreds on dealership fees by knowing exactly what’s wrong before you visit a shop. The #1 choice car scanner for DIYers and car owners who want to take control of their vehicle’s health
- 【Clear & Reset CEL with Confidence】Unlike cheap code readers that just erase codes temporarily, NT301 works like all professional vehicle code readers: It clears the check engine light only after you’ve fixed the underlying issue. If the problem isn’t fully repaired, the fault code will reappear. So you’ll never get a false pass. Use the foxwell scanner to verify your repair work and drive with peace of mind
- 【Sm-og Check Helper – Know Your Pass/Fail Status Before the Test】With dedicated one-click I/M readiness hotkeys and a simple Red-Yellow-Green LED indicator, you’ll instantly know if your vehicle is ready for annual testing. Built-in speaker provides clear audio feedback. No guesswork—just confidence before you head to the test center. One less thing to worry about when inspection day comes
- 【Advanced OBDII Modes – O- 2 Sensor & EVAP Testing】NT301 go beyond basic code reading with enhanced OBD2 modes. Run an EVAP system check to assess fuel tank condition, and use the O- 2 sensor test to optimize air-fuel ratio, boosting fuel economy, cutting em- issions, and saving you money at the pump. The code reader for cars and trucks is like having a mini em-issions lab in your glove box
- 【Live Data Graphing – Spot Engine Issues in Real Time】View and log live sensor data in easy-to-read graphs with this OBD2 scanner diagnostic tool. Monitor ox- ygen sensors, fuel trims, coolant temperature, RPM, and more to spot suspicious values instantly. This obd scanner gives you professional-grade insight without the pro price tag—a feature you won’t find on basic $20 car code readers
It is important to distinguish several different kinds of access:
- Live or recent location: where the vehicle is now or was recently seen.
- Historical location: stored records showing repeated movements over time.
- Consumer-app access: information available to the account holder through MySubaru.
- Employee-tool access: information available through Subaru’s internal systems for certain job functions.
- Unauthorized access: what an attacker might obtain after taking over an employee account.
Subaru acknowledged that some employees can access customer location data when relevant to their jobs, citing emergency response and collision-related assistance. That is separate from the reported vulnerability, but it raises an ongoing privacy question: how much location history is retained, who can retrieve it, what approvals are required, and how access is audited.
The cited reporting does not establish that every employee had unrestricted access, nor does it establish exactly how long Subaru retains historical records for every customer. The safer conclusion is that at least one year was available in the researchers’ test case.
Could someone steal a Subaru remotely?
Not in the way the headline might suggest. The researchers demonstrated remote engine start, not remote driving. The reported access did not provide remote steering, shifting, or a demonstrated bypass of the vehicle’s immobilizer.
Remote unlocking could still create real risks. An attacker might enter the vehicle, steal items, tamper with it, or use the feature as part of stalking or harassment. Remote starting could also create safety or security problems. But starting the engine is not the same as taking control of the vehicle and driving it away.
Free tools Windows power users keep installed
One-click scans. No signup required.
To steal the car, an attacker would still need another way to defeat the immobilizer and satisfy the conditions required to operate the vehicle. Subaru’s separate key and immobilizer controls remained a barrier, according to the published reporting.
Rank #3
- [Diagnose Like a Pro] BlueDriver Pro is a professional OBD2 scanner and diagnostic tool that helps you scan, understand, and clear vehicle trouble codes with confidence. Turn your phone into a powerful car diagnostic scanner—no guesswork, no unnecessary repairs.
- [Read and Clear More Codes Than Ever] Read and clear more codes than basic car code readers. Access enhanced diagnostics for Check Engine, ABS, SRS, Airbag, TPMS, Transmission.
- [Verified Fixes and Real-Time Data] Get unlimited, technician-verified repair reports matched to your VIN, with definitions, causes, and confirmed fixes. Monitor live vehicle data as you drive, view freeze frames, check smog readiness, and analyze Mode 6 test results.
- [Wireless & Bluetooth Enabled] - Say goodbye to wires. BlueDriver connects with Bluetooth via your phone/tablet to a sensor that plugs into your car's OBDII port. Get all of the capabilities of an expensive code reader & scan tool without any annoying wires.
- [Broad Make & Model Coverage] Strong support for GM, Ford, Stellantis (RAM, Jeep, Chrysler), Toyota, Honda, Nissan, Mazda, Subaru, Hyundai, Mercedes-Benz, BMW, and VW.
Which Subarus were potentially exposed?
The reported potential scope was millions of Subaru vehicles equipped with the company’s STARLINK connected services in the United States, Canada, and Japan.
That does not mean every Subaru, every model year, or every vehicle in those countries was vulnerable in exactly the same way. Connected-service availability depends on factors including:
- Model and model year
- Whether the vehicle has the relevant telematics hardware
- Market and regional backend systems
- Network compatibility
- Account enrollment
- Subscription status
Subaru’s current connected-services information lists availability by model year, plan, and 4G support, including certain vehicles from model years 2016 through 2025. That current product information should not be treated as a definitive model-by-model list for the 2024 vulnerability.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA vehicle without an active subscription may not have had the same remote functions enabled, but that does not automatically answer what customer or historical data Subaru retained internally. The public reporting does not provide enough information to classify every vehicle individually.
Was this a data breach?
It was clearly a serious security vulnerability and an unauthorized-access path. It is more cautious—and more accurate—not to call it a confirmed mass data breach.
The researchers accessed selected accounts with permission for testing. Subaru said it was notified in late November 2024, patched the issue immediately or within 24 hours, and found no evidence that customer information had been accessed without authorization. Public reporting does not establish that criminals exploited the flaw at scale or that a particular number of customers were harmed.
Rank #4
- Understand Your Check Engine Light – The ANCEL AD410 OBD2 scanner helps everyday drivers quickly read and clear engine-related fault codes, view code definitions, and understand why the check engine light is on before visiting a repair shop. With 42,000+ built-in DTC lookups, this car code reader helps reduce guesswork and makes basic vehicle diagnostics easier for beginners and DIY users
- Full OBD2 Diagnostics Made Simple – More than a basic engine code reader, this OBD2 scanner diagnostic tool supports key OBDII functions including reading/clearing codes, live data, freeze frame, I/M readiness, O2 sensor test, EVAP test, vehicle information, and MIL status. It helps you check your car’s condition, verify repairs after the issue is fixed, and communicate with mechanics more confidently
- Live Date & Real-time Vehicle Insights – View real-time engine data such as RPM, coolant temperature, fuel trim, oxygen sensor readings, and other available OBD2 parameters directly on the screen. These live data readings help you better understand how your vehicle is running, spot abnormal patterns, and make more informed repair decisions instead of relying only on a warning light
- Smog Check Readiness At A Glance – Use the I/M readiness function before a smog check or emissions inspection to see whether your vehicle’s monitors are ready. This OBD2 code scanner helps you confirm if recent repairs have brought the system back to a ready state, reducing the chance of failed inspections, retests, wasted trips, and unnecessary inspection fees
- Works With Most OBD2 Vehicles – Compatible with most 1996 and newer U.S.-based OBD2 cars, SUVs, and light trucks, as well as many 2000 and newer EU/Asian OBD2 vehicles. Supports major OBDII protocols including CAN, ISO9141, KWP2000, J1850 VPW, and J1850 PWM. This automotive diagnostic scanner is designed for wide vehicle coverage; please check compatibility with your vehicle before purchase
That is why “millions of Subarus were hacked” overstates the evidence. The more precise description is that millions of potentially connected vehicles may have been reachable through a shared vulnerable administrative system, while researchers demonstrated the flaw on a much smaller number of authorized test vehicles.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When was the vulnerability fixed?
Curry and Shah discovered the issue in November 2024 and reported it to Subaru in late November. Subaru said it patched the vulnerability immediately; other accounts describe the affected system as patched within 24 hours of notification. The findings became public on January 23, 2025.
As of August 16, 2026, the cited public material does not establish a recurrence of this specific vulnerability. That does not prove that every part of Subaru’s connected-car security architecture is risk-free. It means only that the reported portal flaw was patched, according to Subaru and the researchers’ accounts.
Because the weakness was in a web-based employee portal, the fix was primarily server-side. Owners should not assume that a dealership software update is required—or that replacing a key, head unit, or telematics module would address this particular issue.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Subaru’s response and the remaining privacy issue
Subaru’s reported response had several parts:
- The company was notified by the researchers in November 2024.
- The reported vulnerability was patched immediately or within 24 hours.
- Subaru said no customer information was accessed without authorization.
- The researchers’ vehicle tests involved accounts whose owners had given permission.
- Subaru acknowledged that certain employees can access location data when it is relevant to their work.
- Subaru has said it does not sell location data.
These statements address the immediate incident, but a patch does not resolve every question about connected-car privacy. A secure system can still collect more data than owners expect, retain it for longer than necessary, or make it available to more internal personnel than is appropriate.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For automakers, the important safeguards include least-privilege access, role-based restrictions, detailed audit logs, anomaly detection, limits on historical lookback, approval workflows for sensitive searches, and clear owner notifications when a new authorized user is added. The published reporting shows that researchers encountered broad capabilities; it does not establish that every one of these safeguards was absent.
Best Value
- [Easy to Use—Work Out of the Box] + [FOXWELL 2026 New Version] FOXWELL NT604 Elite scan tool is the 2026 new version from FOXWELL, designed for car owners who want to figure out the cause of issues before fixing car problems by scanning common systems like ABS, SRS, engine, and transmission. The NT604 Elite obd2 scanner diagnostic tool comes with the latest software—no need to waste time downloading software first. Plug the scanner into the OBDII port with OBDII cable to start the diagnosis.
- [Affordable] + [Reliable Car Health Monitor] Will you be confused what happens when the warning light of ABS/SRS/transmission/check engine flashes? Instead of taking your cars to dealership, this FOXWELL scanner will help you do a thorough scanning and detection for your cars and pinpoint the root cause. Note：The device is a diagnostic tool, not a repair tool. To turn off a warning light, you must first physically repair the issue causing it. Only then can the scanner be used to clear the corresponding fault code.
- [5 in 1 Car Diagnostic Scanner] Compared with obd scanners (50-100), NT604 Elite code scanner not only includes their OBDII diagnosis but also serves as ABS/SRS scanner, transmission and check engine code reader. When it’s an odb2 scanner, you can use it to check if your car is ready for annual test through I/M readiness menu. In addition, live data stream, built-in DTC library, data play back and print, all these features are a big plus for it. Note: doesn't support maintenance functions like reset or relearn. For the SRS system, NT604 Elite can read and clear common fault codes not caused by a crash, but crash/collision data cannot be cleared.
- [Fantastic AUTOVIN] + [No extra software fee] Through the AUTOVIN menu, this NT604 Elite car scanner allows you to get your V-IN and vehicle info rapidly, no need to take time to find your V-IN and input one by one. What's more, the NT604 Elite ABS SRS scanner supports 60+ car brands from worldwide (America/Asia/Europe). You don’t need to pay extra software fee. AUTOVIN may not work on some older vehicles or certain vehicle brands. If AUTOVIN fails, please input the vin code manually or go to the Diagnostic Menu to select your vehicle model.
- [Solid protective case KO plastic carrying bag] + [Lifetime update] Almost all same price-level car scanner diagnostic tool only offers plastic bag to hold the scanner.However, NT604 Elite automotive scanner is equipped with solid protective case, preventing your obd2 scanner from damage. Then you don’t need to pay extra money to buy a solid toolbox.
What Subaru owners should do now
The reported vulnerability was patched centrally, so there is no cited evidence that owners need to replace hardware or disable their vehicles. Owners can still reduce account risk and check for lingering access:
- Use a unique MySubaru password. If the password was reused on another site, change it there too.
- Enable available account security features. Use multifactor authentication if it is offered for your account and region.
- Review authorized users and linked vehicles. Remove former household members, former owners, service contacts, or anyone else who no longer needs access.
- Check account-recovery details. Confirm that the email address, phone number, and other recovery information belong to you.
- Pay attention to unexpected activity. Treat unexplained remote unlocks, starts, location lookups, account changes, or vehicle movement as a possible account-security incident.
- Contact Subaru support if anything looks wrong. Ask the company to investigate unfamiliar users, vehicle actions, or account changes.
- Ask privacy questions. Ask what location history is retained, which personnel can access it, how access is logged, how long records are kept, and whether deletion or restriction requests are available in your market.
Used-car buyers and people who have sold a Subaru should pay particular attention to account transfer. A vehicle can remain associated with a former owner or authorized user if the account relationship was not properly removed. Household members, dealerships, emergency contacts, and service representatives may have legitimate access, so review the list rather than deleting every unfamiliar name without checking.
What this incident says about connected cars
The Subaru case demonstrates that connected-car security is not limited to the software inside the vehicle. The risk can also sit in the automaker’s web portals, employee permissions, account-recovery systems, databases, and customer-support workflows.
It also shows why location data deserves treatment comparable to other highly sensitive personal information. Remote lock and start are visible features that owners can understand. A detailed historical movement record may be less obvious, yet it can reveal far more about a person’s life.
Connected services offer genuine benefits, including emergency assistance, remote lock and unlock, vehicle location, stolen-vehicle support, and remote starting. The trade-off is that those functions require the automaker to collect and manage identity and movement data. Security therefore requires both a patched technical system and disciplined data governance.
Bottom line
The Subaru vulnerability was real and serious, but the popular shorthand needs qualification. Researchers found a way through an employee-facing portal to control connected-service functions and access extensive location history. The potential scope was millions of STARLINK-equipped vehicles in three markets, not millions of confirmed victims. The flaw was patched after disclosure, and there is no cited public evidence of mass criminal exploitation.
The demonstrated attack did not let someone remotely drive a Subaru or bypass its immobilizer. The longer-lasting lesson is about access to location data: even when a vulnerability is fixed, owners deserve clear answers about what connected-car information is collected, how long it is kept, who can see it, and what controls prevent misuse.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Sources: Wired’s report, the researchers’ technical write-up, TechCrunch’s summary, and Subaru’s current connected-services information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
