Toyota receives Japanese administrative guidance due to information leakage case involving 2.41 million pieces of user data

According to Reuters, Japan’s Personal Information Protection Commission announced today that it has issued administrative guidance to Toyota Motor Corporation in accordance with the Personal Information Protection Law. A Toyota subsidiary previously caused concern when the customer data it managed was disclosed, and Japan's Personal Information Protection Commission required Toyota to take necessary and appropriate measures to securely manage personal data.

In May this year, Toyota announced that approximately 2.41 million pieces of Japanese customer data (such as vehicle location information) outsourced to its subsidiary Toyota Connected (TC) may have been leaked. Due to a misconfiguration of the cloud environment, this data has been available to the public on the Internet for nearly a decade starting in 2012.

Also in May this year, Toyota said that due to a cloud setting error, customer information in some countries in Asia and Oceania may have been publicly accessible between October 2016 and May 2023. The information involved includes names, addresses, phone numbers, email addresses and vehicle identification and registration numbers.

Japan's Personal Information Protection Commission said Toyota did not handle data correctly due to insufficient training for employees on personal information and that access controls were not implemented properly due to imperfect settings in the cloud environment. Toyota announced measures on July 10 to prevent such an accident from happening again.