Toyota Says Account Linking Error Exposed Customer Information

Toyota Financial Services, Inc. (TFS) has disclosed a data breach that affected customer accounts due to an account-linking error dating back to the fall of 2021.

Toyota Financial Services is a subsidiary of Toyota Motor Corporation, providing auto financing across 90% of markets where Toyota operates. The company has a global presence, offering various financial products to Toyota customers.

This security incident, only reported in June 2024, highlights significant delays in notifying impacted individuals and underscores ongoing concerns about data security practices within major financial institutions.

Incident overview

The breach originated from issues with TFS's account-linking feature, which allows customers to manage multiple loans through the TFS website, smartphone app, and interactive voice response system (IVR). An investigation, initiated immediately upon discovering the anomaly, revealed that certain customer accounts were mistakenly linked to others. This error enabled some customers to view their personal information on unrelated accounts.

The compromised data included:

• First and last names
• Addresses
• Partial Social Security numbers
• TFS account numbers

More sensitive information, such as full Social Security numbers and bank account details, were not affected. TFS has stated that there is no increased risk of fraud or identity theft resulting from this breach. However, affected customers are urged to review their accounts for any anomalies and report discrepancies promptly.

Since uncovering the breach, TFS has conducted a thorough review and delinked affected accounts. They have also implemented additional procedural safeguards to prevent such incidents in the future. TFS has notified the relevant regulatory authorities and provided guidance to customers on how to protect their personal information. The company says it remains committed to the security of customer data, though the prolonged delay in notification raises concerns about its incident response efficiency.

Past Toyota lapses

This breach is not an isolated case for Toyota. In December 2023, TFS suffered another significant data breach involving unauthorized access to its systems in Europe and Africa. The Medusa ransomware group claimed responsibility, demanding $8,000,000 to delete the stolen data.

The compromised data, which was leaked on Medusa's extortion portal, included sensitive personal and financial information of customers. This incident highlighted vulnerabilities in Toyota's cybersecurity measures and resulted in substantial operational disruptions.

Protection for customers

To mitigate potential risks, TFS advises customers to:

• Regularly review account statements and credit reports for suspicious activity.
• Consider placing a security freeze on credit reports to prevent unauthorized access.
• Place an initial or extended fraud alert on credit files to prompt verification before new credit is extended.