DriveSure Data Breach Exposes 3.68 M Customer Records Including Vehicle Details
What Happened — In December 2020, DriveSure, a service provider for car dealerships, suffered a breach that resulted in the download of 26 GB of data. The leak, later posted on a hacking forum, contained 3,675,099 records with email addresses, names, phone numbers, physical addresses, vehicle make/model/VIN/odometer, and a small set of bcrypt‑hashed passwords.
Why It Matters for Trust & Control Assurance —
- The incident illustrates the risk of insufficient third‑party oversight; continuous monitoring of vendor security controls is essential to detect gaps before data is exfiltrated.
- Demonstrable evidence of access‑control policies, credential protection, and audit logging can provide a defensible trail for regulators and auditors.
- Mapping the provider’s controls to a common framework (VCF) lets you show due‑diligence across multiple compliance regimes with a single control objective.
Who Is Affected — Automotive retail (car dealerships) and any organization that relied on DriveSure’s platform for customer data.
Recommended Actions —
- Initiate a third‑party risk review of DriveSure, requesting recent SOC 2 or ISO 27001 evidence.
- Verify that password storage uses strong hashing (bcrypt) and that MFA is enforced for all privileged access.
- Incorporate continuous vendor‑monitoring feeds into your control‑assurance dashboard to capture future anomalies. Source: [HIBP]
Technical Notes — The breach involved bulk data exfiltration; no specific vulnerability (CVE) was disclosed. Exposed data types include personally identifiable information (PII) and vehicle identifiers. Source: [HIBP]