We know where your car is parked: What the Volkswagen data breach means for UK EV owners
It started when a whistleblower flagged an issue. Then a hacker collective confirmed it. By December 2024, the world learned that Volkswagen Group had exposed the movement and personal data of around 800,000 electric vehicle owners.
For drivers across Europe, this was a huge invasion of privacy, with deeply personal implications.
What happened in the Volkswagen data breach?
According to reports, Volkswagen’s software subsidiary, Cariad, had misconfigured part of its cloud infrastructure. The result? Vast volumes of sensitive EV data were left unsecured in an Amazon Web Services (AWS) bucket – freely accessible to anyone who knew where to look.
Among the affected brands were Volkswagen, Audi, SEAT and Škoda. Precise GPS data from around 460,000 cars was exposed, sometimes down to the nearest 10 centimetres. And it wasn’t anonymised.
Movement maps and personal identities
The exposed data created detailed movement profiles: when and where cars were driven, where they were parked, and for how long. In some cases, this revealed people’s homes, workplaces, daily routines – and more sensitive visits, too.
A Spiegel investigation found:
- A German politician’s vehicle data showed regular stops at her home, office, bakery and physiotherapist.
- A former defence official’s car was logged outside military sites and retirement homes.
- EVs were tracked near government buildings, brothels, addiction clinics and even intelligence agency HQs.
The leaked records included names, email addresses, phone numbers and, in some cases, home addresses and vehicle IDs.
Why this matters in the UK
Many of the exposed cars belong to owners in the UK. If your vehicle falls within the affected period or model range, your data, location history, contact details, behavioural habits, could have been at risk.
This information is a goldmine for cybercriminals:
- Phishing: Scams tailored to your habits (e.g. emails referencing places you visit).
- Identity theft: Linking name, address and vehicle ID to other stolen data.
- Physical threats: Knowledge of daily movements could pose security risks.
What did VW do?
The breach was first reported to Cariad and the VW Group by the Chaos Computer Club (CCC), a respected ethical hacking organisation. To VW’s credit, the company responded quickly and resolved the issue. But the damage had already been done.
Experts say the data was left exposed long enough to be accessed by malicious actors, even if there’s no confirmed misuse (yet).
The company referred to the incident as a “misconfiguration”. But for many affected drivers, it felt more like a betrayal of trust.
This isn't just a VW problem
This breach has highlighted wider concerns about the data modern cars collect. As EVs become smarter and more connected, the lines between transport and surveillance are blurring.
Can you claim compensation for the VW data breach?
Whether you drive an ID.3, an Audi Q4 e-tron or a Škoda Enyaq, one thing is clear: your data is valuable. And when it’s mishandled, the consequences are personal.
If you think you may be affected, don’t wait. Use our quick checker to see if you could be eligible to join the Volkswagen data breach claim.
