MEMPHIS, Tenn. —In a development credit unions will want to be aware of and to which they may want to alert members, a University of Memphis study found that the vast majority of used vehicles examined at a Memphis dealership still contained recoverable personal information from previous owners, raising concerns about privacy and data security,.
Researchers found that 35 of 38 vehicles they inspected had personal data accessible through their infotainment systems, including contact lists, text message conversations, navigation history and account login information, the television station reported.
The study was led by Dr. Christos Papadopoulos, a computer science professor at the University of Memphis, who said the research sought to determine how much personal information remains stored in modern vehicles after they change owners.
“The question we asked is, ‘How much of that information is captured in the car? How much of it stays in the car?'” Papadopoulos told Action News 5.
Used Infotainment Systems Purchased
To expand the study, researchers also purchased used infotainment systems online—including units from BMW, Jeep, Honda and Hyundai vehicles, some costing as little as $20 on eBay. They found recoverable personal information on those systems as well.
Using the recovered vehicle data alongside publicly available social media information, students employed artificial intelligence to create what researchers described as a “digital double” of a former vehicle owner—a detailed profile of the individual’s life.
‘How Easy Would it Be?’
“We asked ourselves, ‘How easy would it be to extract information, and if you were a bad guy, what can I do with it?'” Papadopoulos said, according to Action News 5.
The researchers said the greatest threat does not come from opportunistic vehicle thieves but from individuals with technical expertise who gain access to a vehicle or its infotainment system. Potential risks include identity theft, insurance fraud and stalking, with those risks expected to increase as vehicle technology becomes more sophisticated.
New Procedures Needed
Papadopoulos said the findings highlight the need for automakers and regulators to establish standardized procedures for securely removing personal data from vehicles before ownership changes.
“That’s why we need automakers and regulators to step in and establish processes on how to do this once a person loses ownership of the car,” he told Action News 5.
