Tesla’s Data Breach: Experts debate fallout and implications
By Zion Rufus
A significant data breach involving American car manufacturer Tesla has caught the attention of experts and industry observers.
The company is currently sending notices to thousands of current and former employees whose sensitive information was exposed due to the actions of two former staff members.
Raising complex legal, ethical, and technical considerations, and underscoring the need for robust security measures and responsible handling of sensitive information in an increasingly digital world, the breach revolves around a substantial 100GB database that found its way to German news outlet Handelsblatt in May 2023.
Within this trove of data were thousands of customer complaints concerning the safety of Tesla’s Full Self-Driving (FSD) technology. Additionally, the database contained reports detailing problems with Tesla vehicles’ emergency braking systems, instances of abrupt self-acceleration, false collision warnings, and more.
On May 10, 2023, Tesla was informed by Handelsblatt that it had acquired confidential information related to the company. An ensuing investigation discovered that two ex-employees had violated Tesla’s IT security and data protection policies by misappropriating information, which was later shared with the media outlet. Handelsblatt has clarified its intention not to publish any personal information, acknowledging its legal constraints regarding inappropriate usage.
The leaked data was reportedly aimed at highlighting significant security concerns with Tesla vehicles. The former employees behind the leak alleged that the carmaker was actively concealing these issues from the public eye. The data shared with Handelsblatt was explicitly marked “for internal use only,” indicating a concerted effort to withhold such reports from public scrutiny.
Following an internal probe, Tesla has confirmed that 75,735 current and former employees have been affected by the breach. The exposed details include full names, physical addresses, phone numbers, and email addresses. Notably, there is no indication that customer information was included in the leaked data.
To address the breach, Tesla has taken legal action against the two former employees, leading to the confiscation of their electronic devices. Court orders are in place, preventing them from accessing or disseminating any Tesla data. Additionally, the company has included instructions in the notices sent to affected employees on how to enroll in Experian’s credit monitoring and identity detection services, helping them mitigate potential risks from scammers and cybercriminals.
Industry Experts Weigh In on the Matter
In a LinkedIn post, Oyindolapo Olusesi, technology lawyer and the founder of Mustarred Crest delved into the legal intricacies, discussing how the former employees’ actions relate to confidentiality obligations to the company and the protection of personal data.
Speaking further, Olusesi raised questions about public interest and the potential for these employees to become data controllers at some point.
“I’m interested to see how the employees wiggle out of the breach of confidentiality to Tesla. I think a radical court may be willing to grant an exception in the public interest. But in very strong conditions,” he said.
Joe Salvati, CEO at Arcuity dissected the notion of public interest, asserting that merely having issues with products doesn’t necessarily constitute public interest. He predicted that the former employees might face a lawsuit from the company and challenged the ethical implications of stealing and dispersing private data.
Greg Kingma, launch management & CEO of Spartan addressed the divergence between Tesla’s communication and the alleged facts.
In his defense, Kingma pointed out that he had notified Tesla InfoSec of a personal data leak in March 2023. Challenging Tesla’s assertion that there is no evidence of data misuse as he described consequences faced by him and his family as a result of the breach, he revealed “My Family and I were forced to move due to receiving threatening emails and letters. And my family has since been threatened from the State prosecutor out of Frankfurt Oder raising the suspicion of political manipulation and bias in Tesla’s favor seemingly rather than rule of law with data protection. Compliance? As 24th March (the day I informed Tesla InfoSec to 13th May 2023 most seemingly does not follow the 72 hour requirement. Another instance of Shocking mis-management and cover up by Senior Management in Grünheide. Hopefully this does not destroy all the hard work Tesla has done over 2 decades.”
In the conversation, Craig Heartwell emphasized that established methods for whistle-blowing should have been pursued by the former employees if that was their intention.
He asserted that their actions of stealing and exposing private information constitute sabotage and defamation, believing no court should support their actions.
Sultan Murray on his part proposed an alternative perspective, suggesting the breach could be a ploy by Tesla’s competitors to destabilize confidence in the company.
Murray also raised the possibility of employee error rather than malicious intent.
Andrew Hawes addressed the potential merit of the disclosure if it focused solely on product issues but criticized the release of personal information of staff members.
In his viewpoint, Hawes believes there are better ways to establish identity and highlights the severe consequences of exposing sensitive information.
RECOMMENDED ARTICLES
Comment
No comments found.