GM credential stuffing attack exposed car owners' personal info

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,506
US car manufacturer GM disclosed that it was the victim of a credential stuffing attack last month that exposed some customers' information and allowed hackers to redeem rewards points for gift cards.

General Motors operates an online platform to help owners of Chevrolet, Buick, GMC, and Cadillac vehicles manage their bills, services, and redeem rewards points.

Car owners can redeem GM rewards points towards GM vehicles, car service, accessories, and purchasing OnStar service plans.
Personal information exposed

When the hackers successfully breached a GM account, they could access certain information stored on the site. This information includes the following personal details:
  • First and last name,
  • personal email address,
  • personal address,
  • username and phone number for registered family members tied to the account,
  • last known and saved favorite location information,
  • currently subscribed OnStar package (if applicable),
  • family members' avatars and photos (if uploaded),
  • profile picture,
  • search and destination information.
Other information available to hackers when they breach GM accounts is car mileage history, service history, emergency contacts, Wi-Fi hotspot settings (including passwords), and more.

However, the GM accounts do not hold date of birth, Social Security number, driver's license number, credit card information, or bank account information, so that information hasn't been compromised.
 
  • +Reputation
  • Wow
Reactions: upnorth and plat

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top