BMW API restrictions: Difference between revisions
number of affected users added to background |
added security breach section Tag: 2017 source edit |
||
| Line 28: | Line 28: | ||
BMW has not issued an official press release or public statement regarding the API restrictions beyond the in-app notifications. According to user reports on GitHub, attempts to contact BMW customer service resulted in '''''"boilerplate responses citing security as a reason for these very targeted actions."'''''<ref>{{cite web |url=https://github.com/home-assistant/core/issues/149750 |title=Upcoming API changes notification from BMW · Issue #149750 |website=GitHub |date=2025-08-31 |access-date=2025-01-01}}</ref> The company has maintained partnerships with approved charging networks including Electrify America, Shell Recharge, & EVgo.<ref>{{cite web |url=https://www.bmwusa.com/charging.html |title=BMW Electric Vehicle Charging |website=BMW USA |date=2025-01-01 |access-date=2025-01-01}}</ref> | BMW has not issued an official press release or public statement regarding the API restrictions beyond the in-app notifications. According to user reports on GitHub, attempts to contact BMW customer service resulted in '''''"boilerplate responses citing security as a reason for these very targeted actions."'''''<ref>{{cite web |url=https://github.com/home-assistant/core/issues/149750 |title=Upcoming API changes notification from BMW · Issue #149750 |website=GitHub |date=2025-08-31 |access-date=2025-01-01}}</ref> The company has maintained partnerships with approved charging networks including Electrify America, Shell Recharge, & EVgo.<ref>{{cite web |url=https://www.bmwusa.com/charging.html |title=BMW Electric Vehicle Charging |website=BMW USA |date=2025-01-01 |access-date=2025-01-01}}</ref> | ||
==Past data security incidents== | |||
BMW's justification for API restrictions cited ''"security"'' concerns, yet BMW has repeatedly failed to adequately secure customer & internal data in areas that have nothing to do with homeassistant integrations. In July 2024, BMW Concessionaires in Hong Kong suffered a breach exposing personal data of about 14,000 customers which included names & mobile numbers.<ref>{{cite web |title=BMW Hong Kong Data Breach Exposes Customer Information |website=Daily Security Review |date=2024-07-05 |url=https://dailysecurityreview.com/security-spotlight/bmw-data-breach/ |access-date=2025-09-04}}</ref> | |||
In early 2024, researchers discovered a misconfigured Microsoft Azure storage bucket that exposed private keys, credentials, & other sensitive internal BMW data to the public internet.<ref>{{cite web |title=BMW Security Error Left Valuable Private Company Data Exposed Online |website=TechRadar |date=2024-03-14 |url=https://www.techradar.com/pro/security/bmw-security-error-left-valuable-private-company-data-exposed-online |access-date=2025-09-04}}</ref> | |||
In February 2025, BMW Financial Services North America reported a breach via its vendor AIS InfoSource LP that affected nearly 2,000 individuals, with exposed data including names, Social Security numbers, account numbers, & more..<ref>{{cite web |title=BMW Financial Services Data Breach Affects Nearly 2,000 Customers |website=Claim Depot |date=2025-03-01 |url=https://www.claimdepot.com/investigations/bmw-financial-services-data-breach-2025 |access-date=2025-09-04}}</ref> | |||
==Consumer response== | ==Consumer response== | ||