Data breach at Hyundai AutoEver America exposes 2.7m customer data

• Offers two years of complimentary credit monitoring to those notified, encouraging vigilance for signs of identity theft or financial fraud.

Hyundai AutoEver America (HAEA), the official IT services arm for Hyundai, Kia, and Genesis in North America, is grappling with the aftermath of a significant data breach that has raised urgent questions about cybersecurity and customer trust in the automotive sector.

The incident, discovered on March 1, 2025, saw unauthorised access to HAEA’s networks for a period of over a week—beginning February 22 and continuing through March 2, according to statements by the Hyundai Motor Group–owned subsidiary.

HAEA, which operates out of California and manages IT systems for more than 2.7 million connected vehicles and 2,300 dealerships across North America, immediately engaged law enforcement and external cybersecurity experts to investigate and contain the threat.

While the company began reaching out to affected individuals with notification letters on October 30, HAEA has not publicly specified the total number impacted. Regulatory filings, however, suggest the breach could involve highly sensitive data—including names, social security numbers, and driver’s license information.

Customer guidance

“The compromise of social security numbers escalates the severity of this breach,” cautioned Pete Luban, Field CISO at cybersecurity firm AttackIQ.

“Unlike passwords or credit cards, social security numbers can’t be easily changed, increasing the risk of long-term fraud schemes.” Luban also warned that exposed data could fuel ongoing phishing attacks targeting affected customers.

In response, Hyundai AutoEver Americais offering two years of complimentary credit monitoring to those notified, encouraging vigilance for signs of identity theft or financial fraud.

Cybersecurity experts advocate for customers to monitor financial accounts closely and adopt best practices, such as enabling multi-factor authentication and verifying online communications.

Broader implications

Hyundai AutoEver America’s reach extends beyond vehicle software, encompassing IT infrastructures for dealerships and connected car platforms in both the US and abroad. While the company boasts over 600 partners and 2,200 IT professionals globally, it remains unclear if the breach affects individuals outside North America.

This incident underscores escalating cybersecurity risks in the automotive sector, especially as vehicle connectivity, telematics, and digital infrastructure become increasingly integral to automotive operations and the customer experience. Industry stakeholders are watching closely as Hyundai works to restore trust and reinforce its digital defenses.