In October 2022 Toyota Motor Corporation disclosed that part of the source code for T-Connect — its connected-vehicle app — had been sitting in a public GitHub repository since December 2017. A development subcontractor had pushed the code without permission, and the repository included an access key to the data server that stored customer email addresses and management numbers.
What actually happened
Toyota's own statement walks through the chain of events. A development partner uploaded part of the T-Connect site's source code to a public repository in December 2017. The repository contained an access key to the database server hosting customer information. The repository was made private on 15 September 2022 after a third party reported it, but anyone who cloned it during that five-year window still had the key.
Why the blast radius was bounded — barely
Toyota reported no evidence that customer data was actually accessed, but they could not rule it out, which is why they had to notify nearly 300,000 customers. The data exposed was relatively narrow — email addresses and an internal management number, not payment details or full PII — but for a connected-vehicle service the reputational damage is significant. The credential itself was rotated after discovery, but that does not retroactively protect data that may have been queried during the exposure window.
The three failures in this incident
- A contractor pushed production-shaped code to their personal account without review.
- The repository contained a database credential checked into source, instead of being injected from a secret manager at runtime.
- Nobody at Toyota was watching public GitHub for code or credentials tied to the t-connect domain — discovery came from an outside report.
The pattern repeats
T-Connect is not unique. Mercedes-Benz (a leaked GitHub token in early 2024 exposed internal source code and cloud credentials), Samsung (Galaxy source code published to a private group in 2022 was scraped within hours), and dozens of smaller incidents all follow the same shape: a contractor or junior engineer pushes code into the wrong repo, and an attacker finds it before the owner does.
The defensive lesson is the same every time: organizations need continuous, name-aware scanning of the open web for code, domains, and credentials that look like theirs — independent of whether the leak happens on an asset they technically control.
“We sincerely apologise for the great inconvenience and concern caused.”