Audi USA Vendor Leak Exposes 2.74 M Customer Records Including SSNs and VINs
What Happened – In August 2019 a third‑party vendor for Audi USA left a database containing 2,743,539 customer records exposed on the public internet. The data set included names, email addresses, phone numbers, physical addresses, driver’s‑license numbers, dates of birth, Social Security numbers and vehicle details such as VINs.
Why It Matters for Trust & Control Assurance
- This incident is a textbook example of a supply‑chain control gap that a continuous third‑party risk‑management program is designed to detect and remediate.
- Demonstrable evidence of vendor oversight (contractual security clauses, periodic attestations, continuous monitoring) provides a defensible audit trail for frameworks that map to the same control objective.
- Verisq’s Vendor Risk Management capability supplies the real‑time assurance artifacts needed to prove due‑diligence to auditors and regulators.
Who Is Affected – Automotive customers in the United States; any organization that shares personal or vehicle data with third‑party service providers.
Recommended Actions
- Inventory all third‑party contracts that involve personal data and verify that they contain explicit security and data‑handling requirements.
- Deploy continuous monitoring of vendor environments (e.g., external asset discovery, configuration scanning) to surface unsecured exposures promptly.
- Update incident‑response playbooks to include vendor‑originated breaches and conduct tabletop exercises.
Source: Have I Been Pwned – Audi breach
Technical Notes – The exposure resulted from an unsecured cloud storage bucket left publicly readable. No specific CVE is associated; the root cause is a vendor‑side misconfiguration. Data types exposed: PII (SSN, DOB, driver’s license), contact information, and vehicle identifiers (VIN). Source: same as above