Toyota's cyber problems continue: The latest data theft is the fifth major IT incident in two years

Toyota has confirmed that its network was breached after a threat actor listed a 240GB trove of data stolen from the company's internal systems on an underground hacker forum.

The Japanese automaker admitted on August 19 that its systems had been compromised after a threat collective known as ZeroSevenGroup stated that there had been a break-in at one of the company's US offices.

According to ZeroSevenGroup, the cache contains confidential personal information about the company's employees and customers, including financial information, emails, photos, databases and network infrastructure.

There is still speculation about which system exactly was compromised by the group and whether the attackers compromised an internal Toyota system or gained access through an independent third party.

ITPro contacted Toyota for clarification, but the company did not respond immediately.

The attackers used the ADRecon tool to quickly identify and extract large amounts of information from the Active Directory of the affected system, including credentials for critical network infrastructure.

Akhil Mittal, senior security consulting manager at Synopsys Software Integrity Group, said the use of ADRecon underscores the high level of current cyber threats.

“The fact that hackers used a tool like ADRecon to penetrate Toyota's systems shows how advanced cyber threats have become. ADRecon can penetrate deep into a company's network and extract a lot of detailed information, which is quite worrying.”

“This is not just Toyota's problem. It shows that traditional security measures may no longer be enough. We need to move to a proactive, intelligence-led approach to stay ahead of these complex threats. That means investing in better threat detection, conducting regular security assessments and having a solid contingency plan.”

The files appear to have been created or stolen on December 25, 2022, according to reports from Beeping computer, This could indicate the date on which the attackers gained access to the server in question.

Toyota continues to struggle with IT deficiencies

This is the latest in a series of IT incidents at the world's largest car manufacturer.

In November 2023, the company's financial division, Toyota Financial Services (TFS), was listed on the Medusa ransomware group's data leak site on the dark web.

Although it was not caused by a cyber attack, Server maintenance error resulted in 14 Toyota production facilities being closed in September 2023.

In May 2023, it was announced that a Cloud configuration error resulted in the data of over two million Toyota customers being disclosed for ten years.

Less than a year earlier, in October 2022, the company discovered a server that stored the data of nearly 300,000 customers publicly available for the last five years.

Jason Kent, hacker at Cequence, reported on the Japanese automaker's recent IT problems and explained how this latest incident was possible.

“Toyota is at it again. After a few outages with insecure cloud servers, they managed to get out of the news, but not out of sight of the attackers. The battle that is constantly being waged against global organizations is why we often see a small mistake leading to huge problems,” he explained.

“In this case, a Toyota server was hacked that was apparently not really important. In addition, many internal credentials were lost because tools were installed that could harvest data from a network and data was leaked to the attackers' servers. However, the unimportant server appears to be some kind of backup. This means that transactions, accounts and customer data that are actually still relevant were stolen.”

Toyota's cyber problems continue: The latest data theft is the fifth major IT incident in two years

You may also like...

Recent Posts

Toyota's cyber problems continue: The latest data theft is the fifth major IT incident in two years

You may also like...

The odds for a Naoya Inoue victory by KO/TKO in rounds 1-2 have been increased to 5/1 today as the undisputed junior featherweight champion faces Ireland's TJ Doheny in Tokyo.

Elliot Whitehead: Trent Robinson ‘not in line’ for refusing to apologize

Scarlett Johansson honored in TIME100 2024 list for her fight against unauthorized use of AI |

Recent Posts