Loading story…
A Northeastern University and Consumer Reports study of 21 connected vehicles spanning 19 brands and 30 companion apps found widespread communications with third-party advertising, tracking, analytics, and technology domains. Researchers observed traffic during driving and idle tests, using DNS requests, TLS Server Name Indication, timing, and transfer volumes to identify destinations despite encryption. Nineteen of 21 vehicles contacted at least one third party over Wi-Fi; Tesla’s Model 3 contacted 34 advertising, tracking, and analytics domains and 37 infotainment-app domains, while Alphabet domains were the most frequently observed, including doubleclick.net and googlesyndication.com.
The observed sharing could expose or link VINs, precise location, names, email addresses, vehicle identity, and travel patterns to advertising or data-broker profiles. Seven companion apps transmitted sensitive identifiers to tracking-associated third parties, and consumers may face substantial feature loss if they decline connected-services terms; Tesla warned refusal could reduce functionality or make a vehicle inoperable. Following disclosure of the findings, Honda said it directed Amplitude to delete received location data and stopped sending location data to that vendor.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
After researchers presented their findings, Honda said it directed Amplitude to delete location data it had received and stopped sending location data to the vendor.
The researchers found that 19 of 21 tested vehicles contacted at least one third party over Wi-Fi, including advertising and tracking-related domains; seven companion apps also transmitted sensitive identifiers to such third parties. Tesla's Model 3 contacted 34 advertising, tracking, and analytics domains, while Alphabet domains were the most frequently observed across the tested vehicles.
Northeastern University and Consumer Reports researchers evaluated 21 connected vehicles across 19 brands and 30 companion applications while vehicles were stationary, driving, and used through their apps. The vehicles tested were model years 2022 through 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcearstechnica.com
Open sourceconsumerreports.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **U.S. Federal Trade Commission (FTC)** finalized a **20-year consent order** with **General Motors (GM)** and its subsidiary **OnStar** after alleging the companies collected and sold **precise geolocation** and **driving behavior** data from millions of drivers without valid consent. The FTC said GM’s now-discontinued *Smart Driver* feature was presented as a driving-habits tool while enabling extensive telematics collection (including location and behavior signals such as braking and speed), with data flowing to third parties and ultimately being used by insurers in ways that could affect premiums or coverage decisions. Under the order, GM is **banned for five years** from sharing consumers’ geolocation and driving behavior data with **consumer reporting agencies**. For the full term of the order, GM must obtain **express consent** before collecting, using, or sharing connected-vehicle data (with limited exceptions such as emergency services), and must provide consumer controls including the ability to **opt out/disable precise geolocation collection**, request **copies** of their data, and seek **deletion**. Reporting also notes GM shut down *Smart Driver* in 2024 amid backlash and said it ended related third-party telematics arrangements tied to data brokers such as **LexisNexis** and **Verisk**.
Jun 29, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
The Electronic Frontier Foundation warned that some Android apps have been quietly transmitting users’ precise location data to third-party advertising SDKs after users granted location access to the app itself. EFF said many developers may not realize embedded SDKs inherit the app’s permissions by default, allowing monetization components to collect and send sensitive location data unless developers explicitly disable that behavior. The organization said it identified several affected Android apps with a combined **about 60 million downloads**, while cautioning that the exposed SDKs represent only a small slice of a broader ad-tech ecosystem that reaches billions of users. The data can flow to advertisers and data brokers and may be resold onward, including to governments or intelligence agencies, increasing surveillance, privacy, and breach risks; EFF argued that app-level consent does not amount to meaningful consent for third-party SDK collection and urged developers to turn off unnecessary location sharing.
Aug 7, 2026