Audi audiusa.com Audi data breach: what happened and what to do
In August 2019 a vendor left Audi USA customer data exposed on the internet. Have I Been Pwned counts 2.7 million email addresses, with names, phone numbers, addresses and vehicle details, and for some people driver's licenses and Social Security numbers.
View all 13,115 breaches- Breach date
- 14 Aug 2019
- Affected
- 2,743,539
- Data exposed
- Dates of birth, Driver's licenses, Email addresses, Names, Phone numbers, Physical addresses, Social security numbers, Vehicle details
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In 2021 Volkswagen Group of America told customers that a vendor had left their data unsecured on the internet. Most of the 3.3 million people in the notice were Audi customers or prospective buyers. Have I Been Pwned (HIBP) lists the Audi USA part as 2,743,539 accounts, dated August 14, 2019.
What happened
According to press coverage of the notice, the vendor's unsecured data was exposed between August 2019 and May 2021. The records were sales and marketing data collected from 2014 to 2019. Volkswagen says it learned of the problem on March 10, 2021, started an investigation with outside consultants and notified law enforcement. It did not name the vendor.
What was exposed
HIBP lists dates of birth, driver's licenses, email addresses, names, phone numbers, physical addresses, Social Security numbers and vehicle details. Audi's disclosure said most affected people only had contact details and vehicle information such as the VIN. A smaller group, more than 90,000 according to TechCrunch's reporting, had more sensitive data, including information about loan eligibility.
Contact details plus a car you own is a good setup for scams: a fake recall notice, a warranty call or a message about financing. A driver's license number or Social Security number adds identity theft risk for the people whose records included them.
The company's response
Volkswagen notified customers and regulators and told people to watch for suspicious messages.
What to do if you were in it
- 1
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 2
Be careful with recall and warranty messages
Scammers use your vehicle details to sound legitimate. Check any recall with the manufacturer or at nhtsa.gov by entering your VIN yourself.
- 3
Freeze your credit
Placing a freeze at Equifax, Experian and TransUnion is free and stops new credit being opened in your name. Lift it temporarily when you apply for credit yourself.
- 4
Watch your statements and credit reports
Look over bank and card statements for charges you don't recognize. You can pull free credit reports at annualcreditreport.com.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the Audi data breach?
Volkswagen notified affected customers and prospective buyers by letter or email. You can also search your email address on Have I Been Pwned.
What was exposed?
HIBP lists names, emails, phone numbers, addresses and vehicle details, and for some people dates of birth, driver's licenses and Social Security numbers.
How many people were affected?
HIBP lists 2,743,539 accounts for Audi USA. Volkswagen's notice covered about 3.3 million people across the US and Canada.
Should I freeze my credit?
If your letter said your driver's license or Social Security number was involved, yes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
