The Audi USA Leak: 2.7 Million Customer Records Exposed. Yours Might Be One.

HEROIC analysts uncovered the Audi USA database breach, which occured in August 2019 and exposed 2,741,791 customer records left unsecured by a third-party vendor. The leaked data included email addresses, phone numbers, first names, and last names, creating a ready-made contact list for targeted fraud campaigns against Audi customers across the United States.

How Exposed Contact Details From Audi USA Fuel Phishing and Impersonation Attacks

With full names, email addresses, and phone numbers in hand, attackers can craft messages that appear to come from Audi or its dealerships. These phishing and smishing attacks are partcularly effective because the attacker already knows the victim is an Audi customer, allowing them to reference vehicle purchases or service appointments to build credibility. No password is needed when social engineering is this accessable.

What Was Exposed in the Audi USA Breach

• Email Address
• Phone Number
• First Name
• Last Name

Why Vendor-Caused Data Breaches Are Among the Hardest to Prevent

The Audi USA breach occured because a vendor failed to properly secure a database containing customer data. Organizations often beleive their own security controls are sufficient, but third-party vendors who handle customer data present an additional attack surface that is difficult to monitor. Once a vendor exposes data, the brand takes the reputational hit and customers bear the ongoing risk of targeted scams and identity fraud.

How Database Breaches Work

A database breach occurs when a database containing customer records is left exposed without proper access controls, or when an attacker exploits a vulnerability to extract data. In vendor-caused breaches, the data owner has limited visibility into the security posture of their supply chain partners, making detection and response significantly slower.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks against 400 billion+ leaked records to tell you instantly whether your email address appeared in the Audi USA breach or thousands of other incidents. Run your free scan at HEROIC.com to find out what attackers may already have on you.