Massive Tata Motors Data Leak Exposes 70+ TB of Sensitive Information

Tata Motors, India’s largest automaker, suffered a data exposure that reportedly revealed over 70 terabytes of sensitive information due to multiple security failures, discovered in 2023. The breaches involved plaintext AWS credentials on public-facing websites, encrypted keys that were easily decrypted, a Tableau backdoor with zero authentication requirements, and an unprotected API key from fleet management systems, potentially exposing customer databases, financial records, invoices, and decades of fleet data.

The exposure also granted write access to multiple websites, enabling potential malware injection, with one instance showing a 4-kilobyte file containing tax codes being downloaded using these keys. The security issues were reported to Tata Motors through India’s Computer Emergency Response Team (CERT-IN) on 8 August 2023, and remediation progressed slowly, with only 2 of 4 issues addressed by 1 September 2023 and fully revoked credentials only by January 2024, according to CERT-IN.

The disclosed weaknesses highlighted a pattern of hardcoded credentials, flawed client-side encryption, and authentication gaps that allowed impersonation of users on the Tableau dashboards containing internal and dealer-specific information.