Volkswagen Security Breach: Hacker Unlocks Cars, Exposes Owner Data

At a glance

• A security researcher found serious flaws in the India-only My Volkswagen app that exposed car owners’ data.
• The flaws exposed owners’ personal details, service records and vehicle data.
• Volkswagen said it patched all of the reported flaws on May 6, 2025, and found no evidence of malicious use.
• The case shows how weak app security can expose drivers of connected cars.
• Experts warn that attacks on carmakers’ apps and back-end systems keep growing.

How the flaws were found

The flaws came to light because of a car buyer. Security researcher Vishal Bhaskar was setting up the My Volkswagen app in India, the only market where this version is used, when he ran into trouble with the one-time password (OTP) login and started looking more closely. What he found put the personal data of other Volkswagen owners at risk.

Weak login checks

Bhaskar reported that the app accepted unlimited guesses at its four-digit OTP. With a simple script he could brute-force the code. He also found back-end endpoints that returned owner data when given just a vehicle identification number (VIN), along with internal credentials stored in plain text.

What was exposed

Using only a VIN, the flaws could reveal an owner’s name, phone number, email and address, plus the car’s service history and other vehicle data. That’s a privacy risk. It could be a safety one too.

Owners’ questions

Bhaskar disclosed the issues to Volkswagen before going public, but owners in India were still left wondering how long their names, addresses and service records had been reachable by anyone who knew a VIN, and the episode adds to the doubts many drivers already have about car apps.

How Volkswagen responded

Volkswagen told reporters that all of the identified flaws were fixed on May 6, 2025, that they affected only the Indian app and that it had no evidence anyone exploited them maliciously.

Lessons for carmakers

The fixes for this kind of bug are well known: limit OTP attempts, require proper authentication on every API call, and never return personal data based on an identifier like a VIN that anyone can read off a windshield.

The wider risk to connected cars

This is one of a string of security problems found in carmakers’ apps and web portals. Industry experts want manufacturers and regulators to tighten security requirements, and they expect attacks to grow as cars become more connected.

Building security in

Researchers have long said the same thing. Build security in from the start.

Protecting connected cars

Every new app and online service adds to a connected car’s attack surface. This case was found by a curious owner and fixed before anyone abused it, as far as Volkswagen knows. Owners should install app updates promptly, use strong account passwords and report anything odd to the manufacturer.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.