Volkswagen says more than 3.3 million customers had their information exposed after one of its vendors left a cache of customer data unsecured on the internet.
The car maker said in a letter that the vendor, used by Volkswagen, its subsidiary Audi, and authorized dealers in the U.S. and Canada, left the customer data spanning 2014 to 2019 unprotected over a two-year window between August 2019 and May 2021.
The data, which Volkswagen said was gathered for sales and marketing, contained personal information about customers and prospective buyers, including their name, postal and email addresses, and phone number.
But more than 90,000 customers across the U.S. and Canada also had more sensitive data exposed, including information relating to loan eligibility. The letter said most of the sensitive data was driver’s license numbers, but that a “small” number of records also included a customer’s date of birth and Social Security numbers.
Volkswagen did not name the vendor, and a company spokesperson did not immediately comment.
It’s the latest security incident involving driver’s license numbers in recent months. Insurance giants Metromile and Geico admitted earlier this year that their quote forms had been abused by scammers trying to obtain driver’s license numbers. Several other car insurance companies have also reported similar incidents involving the theft of driver’s license numbers. Geico said it was likely an effort by scammers to file and cash fraudulent unemployment benefits in another person’s name.
Volkswagen’s letter, however, did not say if the company had evidence that the data exposed by the vendor was misused.