Tesla Data Leak: Old Components With Personal Info Find Their Way On eBay

Evidence emerges Tesla doesn’t erase personal data from replaced components and they’re winding up for sale online.

Tesla’s retrofitting service for media control units (MCU) and Autopilot hardware – HW, for short – may not go far enough in protecting owners’ personal data. That’s according to white hat hacker GreenTheOnly. He obtained four units of these Tesla computers off eBay and found the previous owners’ personal data still on them. More worrying, though, was Tesla’s response, or lack thereof, when Green confronted the company with the data.

According to Green, he informed Tesla of his findings before coming to InsideEVs. The Palo Alto, California-based company refused to notify all of its customers that might be affected in a timely manner, although a week before this article was published Tesla did say it would notify one of the affected customers. As of publication, it still hasn’t.

Speaking to InsideEVs, Green said each of the modules he bought had “owner’s home and work location, all saved wi-fi passwords, calendar entries from the phone, call lists and address books from paired phones, Netflix and other stored session cookies.” Netflix session cookies allow hackers to take control of these accounts.

Thus, if you own a Tesla and have had your car retrofitted with new computer hardware, your personal information may be for sale right now on eBay or elsewhere.

How This All Started

The computer swaps Tesla currently performs involves both the MCU on the Model S and Model X and the ICE on the Model 3. On the Model S and X, the MCU and the Autopilot hardware are separate computers. On the Model 3 and now the Model Y, these computers are combined in a single piece of hardware that hackers call ICE.

MCUv1

There are a few reasons why these computers might need to be replaced. For Model S and X, the MCU in older vehicles sometimes need replaced because the first generation, called MCUv1, had issues with excessive logging that made it fail after four to five years. Owners made a petition for Tesla to start offering a retrofit for its second-generation MCU, called MCUv2, which supposedly fixed this defect, and the company made it available in the U.S. on March 3. Before this, Tesla only replaced the MCUv1 with a new or refurbished one. Surprisingly, Green discovered MCUv2 units are also failing, possibly due to manufacturing issues with the EMMC chip. All of these computers, both MCUv1 and MCUv2, are involved in this privacy issue.

MCUv2 from a Tesla Model X