Tesla has attributed a data breach affecting over 75,000 of its employees to insider misconduct. The electric vehicle manufacturer, owned by Elon Musk, disclosed in a data breach notification submitted to the attorney general of Maine that a comprehensive investigation had uncovered two former employees who had leaked personal data of more than 75,000 individuals to a foreign media outlet.
Steven Elentukh, Tesla’s data privacy officer, explained in the notice, “The investigation revealed that two former Tesla employees misappropriated the information in violation of Tesla’s IT security and data protection policies and shared it with the media outlet.”
The compromised data encompasses personally identifiable information such as names, addresses, phone numbers, employment records, and Social Security numbers belonging to both current and former employees, totaling 75,735 individuals.
Tesla identified the recipients of the data as two former employees who transmitted the information to the German newspaper Handelsblatt. The publication, in response, assured Tesla that it would refrain from publishing or inappropriately utilising the information, citing legal constraints, as per the notification.
In May, Handelsblatt reported a substantial breach at Tesla, characterised by the exposure of a wide range of confidential materials, from employee personal information to customer grievances about their vehicles. The cache, named the “Tesla Files,” encompassed over 23,000 internal documents, containing a substantial 100 gigabytes of confidential data. This included personal information of employees, customer financial details, proprietary production information, and customer complaints regarding Tesla’s Full Self-Driving (FSD) features. Notably, Musk’s Social Security number was also included in the data leak.
Tesla takes legal action
Tesla responded to the breach by initiating legal action against the individuals believed to be responsible for the data breach, resulting in the seizure of their electronic devices. The company further obtained court orders restraining the former employees from any further use, access, or dissemination of the data, with the potential for criminal penalties, according to Tesla’s statement.
This incident follows a Reuters report from April, which highlighted Tesla employees sharing sensitive images captured by customer vehicles. Between 2019 and 2022, reports emerged of employees sharing “invasive” images and videos taken by car cameras.
