Exposed VINs Data Breach (2017): What Was Exposed & What To Do

In June 2017, researchers identified an unsecured database containing more than 10 million vehicle identification numbers. The database also held personal information tied to 397,000 unique email addresses and was believed to have been drawn from US car dealerships. The incident was reported on 5 June 2017. No further details on the duration of exposure, the method of discovery beyond researcher identification, or subsequent actions by the data holders have been disclosed.

Breaking down the breach

The exposure consisted of an unsecured database that stored vehicle identification numbers along with linked personal records. Researchers located the database in June 2017 and noted its association with US car dealership sources. The dataset included 397,000 distinct email addresses. No attribution to any specific actor or group has been made public, and the exact circumstances that left the database accessible remain undisclosed.

How a breach like this happens

Incidents involving exposed databases often stem from configuration errors that leave storage systems accessible over the internet without authentication. In sectors that aggregate records from multiple third-party sources, such as dealership networks, data may be copied into central repositories for operational use and then left without access controls after testing or migration. Discovery typically occurs when external researchers scan for open services rather than through internal detection.

About Exposed VINs

Exposed VINs refers to a collection of vehicle identification data drawn from car dealership records. Organisations handling such data typically maintain details on vehicles and their owners to support sales, service, financing, or compliance processes. When records of this type are left unprotected, the combination of personal identifiers and vehicle specifics can extend beyond ordinary contact information to include attributes that remain stable over time.

What data was at risk

The reported exposure involved several categories of personal and vehicle information. The precise scope of each category remains unconfirmed beyond the initial researcher summary.

• Dates of birth
• Email addresses
• Family structure
• Genders
• Names
• Phone numbers
• Physical addresses
• Vehicle details

What's at stake

Individuals whose records appeared in the dataset face the possibility that their contact details and vehicle information could be used for targeted unsolicited communications or more targeted forms of fraud. Vehicle identification numbers paired with owner data can also support attempts to create false documentation or to locate specific assets. For the organisations that supplied the data, the incident underscores the downstream effects of third-party record handling without verified security controls.

What to do if you're exposed

Review account statements and credit reports for unusual activity. Update passwords on any accounts that reuse the exposed email address and enable multi-factor authentication where available. Consider placing a fraud alert with credit bureaus if vehicle or address details were included. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.