Hyundai Suffers Massive Data Breach, Includes Social Security Numbers

Update: Hyundai has provided some additional clarity on the cybersecurity incident involving Hyundai AutoEver America LLC, an IT affiliate of Hyundai.

• Approximately 2,000 individuals, primarily current and former Hyundai AutoEver America and Hyundai Motor America employment-related individuals, may have had employment-related data affected by the incident.
• General customer and/or connected vehicle data was not compromised.
• Out of an abundance of caution, only those who may have been impacted would have received direct notifications that were mailed on or about October 30, 2025.

"Hyundai Motor America takes the security of personal information seriously and continues to implement measures to protect our systems and customers. We have taken proactive steps to address this incident and reassure our customers."

Hyundai is dealing with a massive cybersecurity incident in the United States. The automaker’s IT services division, Hyundai AutoEver America (HAEA), says it suffered a data breach that may have compromised highly sensitive personal information.

The compromised data reportedly includes names, addresses, phone numbers, driver’s license details, and even Social Security numbers, marking one of the largest automotive data incidents in recent years.

TechRadar reports that filings with the Massachusetts Office of Consumer Affairs and Business Regulation indicate the data breach occurred between February 22 and March 2, 2025. It's really not clear why it took more than six months to notify vehicle owners that their Social Security numbers may have been compromised. Those affected are now being offered two years of free identity theft and credit monitoring through Epiq— ironically, that firm fell victim to a ransomware attack in 2020.

Hyundai suffered from two separate data breaches in Europe in 2023 and 2024, both of which exposed similar customer information tied to its connected vehicle systems. Despite those earlier incidents, the automaker was unable to prevent another large-scale cyber intrusion.

As automakers collect increasing amounts of customer and vehicle data to power connected services or tranche off into additional revenue streams, that same information becomes a high-value target for bad actors. In many cases, stolen data from one attack can be cross-referenced with information from previous breaches to create detailed and highly personalized phishing and fraud schemes.

“On March 1, 2025, HAEA became aware of a cyber incident that impacted our information technology environment,” reads the notification. “Upon discovery, we immediately launched an investigation with the support of external cybersecurity experts to assess the scope of the incident, confirm containment, and identify any affected information,” the company wrote.

Hyundai AutoEver America (HAEA) is an affiliate of Hyundai Motor Group that provides IT consulting, managed services, and helpdesk support. It supplies IT solutions tailored to Hyundai and Kia affiliates, including vehicle telematics, OTA (over-the-air) updates, maps, vehicle connectivity, and embedded systems.

Cybersecurity risks are becoming an inescapable part of new vehicle ownership—another reminder for me to keep buying cars from 2000-2010. We didn't know it then, but we definitely know now that it's quietly the best decade for cars we'll ever see.

Become an AutoGuide insider. Get the latest from the automotive world first by subscribing to our newsletter here.