3.3 million customers hit by VW data breach — what to do

iii.iii million customers hitting past VW data breach — what to practice

Several Audi vehicles lined up at a dealership.

(Prototype credit: PAPA WOR/Shutterstock)

Updated June 18 with news that some of the stolen data appears to be on sale in a cybercrime marketplace.

Volkswagen Group of America appear today (June 11) that more 3.3 million potential and bodily Audi customers in the U.S. and Canada had personal data exposed. At least some information was taken without authorization.

"A third political party obtained limited personal data" from an unnamed sales and marketing vendor, a letter sent to state attorneys full general and obtained by TechCrunch said. Further investigation revealed that the vendor had "left electronic information unsecured at some point between Baronial 2019 and May 2021."

Identity theft victim? Here'south 6 things you need to do
The all-time identity theft protection services
Plus: 26 meg stolen passwords found online — see if you lot're affected

The implication is that the unauthorized party got hold of only the to the lowest degree sensitive data, which would not normally enhance red flags. Only considering of the highly sensitive nature of some of the other exposed information, Volkswagen is providing free identity-theft-protection for 900,000 afflicted persons.

All of the data was collected for sales and marketing purposes between 2014 and 2019. The more three.3 million persons affected had some combination of starting time and concluding names, postal addresses, personal or business organization email addresses and phone numbers exposed — basically just contact info.

The data also including vehicle information such as the models purchased, leased or inquired nearly and Vehicle Identification Numbers (VINs).

Withal, 900,000 actual and prospective customers also had more sensitive information exposed that related to "eligibility for a purchase, loan or lease." For "over 95%" of those 900,000 people, Volkswagen of America said in its attorneys-general letter of the alphabet, that sensitive information consisted only of commuter's-license numbers.

Potentially catastrophic consequences

But for the other v% or so — as many as 45,000 people — dates of birth, account or loan numbers, tax identification numbers and U.S. Social Security numbers or Canadian Social Insurance Numbers were exposed.

If that data was indeed stolen during the almost two-year window of exposure, the consequences for the affected individuals could be catastrophic.

With the full proper noun, street address, date of birth and Social Security number/Social Insurance Number for a resident of the U.S. or Canada, an identity thief can brand pretty good headway in opening accounts, collecting benefits and obtaining identification documents or even employment in the victim's name.

Having a commuter's-license number stolen is less astringent, but it's often enough to get started with identity theft. New York State recently notified thousands of residents that fraudulent attempts had been fabricated to collect unemployment benefits in their names as a result of driver'due south-license numbers being exposed on the website of the New York-based insurance company GEICO.

How to get VW'south gratuitous identity-theft protection

Every bit a result, Volkswagen of America is offering two years of IDX credit-monitoring and identity-theft-protection to the 900,000 people who had the almost sensitive information exposed. Messages are being mailed out starting today (June eleven) to all 3.3 1000000 affected individuals, regardless of their levels of data exposure.

The messages to the 900,000 more severely afflicted individuals will contain an enrollment lawmaking with which recipients tin sign upwards for IDX identity protection at https://response.idx.u.s./audivwdataprotect or past calling (833) 406-2408 from ix a.m. to 9 p.thousand. Eastern time Mon through Fri. The deadline to enroll is Sept. 11, 2021.

The letters will likewise include recommendations from IDX on other steps to have, including checking your credit reports and instituting fraud alerts with i of the Big 3 credit-reporting agencies — Equifax, Experian or TransUnion — after activating IDX credit monitoring.

You demand to contact but one credit agency to request a fraud alarm, as that agency will alert the other two. Credit alerts are free and last i year. You will be notified when any potential lender wants to see your credit file, and you lot will often be provided with a free copy of your credit report when the fraud alert is requested.

The IDX letter mentions, merely does not explicitly recommend, the further step of instituting a credit freeze, which will bar any party from viewing your credit files unless you temporarily or permanently "unfreeze" your files. Credit freezes are besides free but must exist requested from each credit bureau individually.

A credit freeze tin besides prevent you from getting additional credit easily, so information technology's all-time only if you lot know that your identity has been stolen or is at great hazard of existence stolen.

For more information about fraud alerts, credit freezes and how and whether to get them, visit our page on what to do if your Social Security number is stolen.

Update: Stolen VW information appears to be on sale online

The information stolen from Volkswagen Group of America appears to exist up for sale in a cybercrime marketplace, reports Vice Motherboard.

The data for sale includes names, email addresses, mailing addresses, telephone numbers and Vehicle Identification Numbers, Vice says the seller stated. Nonetheless, the seller also told Vice that no Social Security numbers nor driver'southward license numbers were role of the data.

That seems to jibe with Volkswagen's hints that the hacker did not become concord of the most sensitive information.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has besides been a dishwasher, fry melt, long-haul commuter, lawmaking monkey and video editor. He's been rooting around in the data-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA dwelling house-applied science conference. You can follow his rants on Twitter at @snd_wagenseil.