Imagine being able to track any car in real time, find out exactly where it’s parked, and then unlock it using just your phone. Not only that, but you could cancel car shipments or access sensitive customer data—all without ever setting foot inside a dealership. Sounds like a scene from a cyber-thriller, right? Except this actually happened, thanks to a security loophole in a major car manufacturer’s dealership portal.

Fortunately, the person who uncovered this alarming vulnerability wasn’t a criminal but cybersecurity researcher Eaton Zveare. According to TechCrunch, Zveare stumbled upon the issue during what he described as a “weekend project,” when he discovered “two simple API vulnerabilities” within the portal. Although he didn’t reveal the automaker’s name, he did confirm that it’s a “famous brand with several sub-brands.”

By exploiting the flaw, Zveare was able to grant himself administrator-level access—the highest permissions possible. That meant he could view sensitive buyer information such as names, addresses, financial details, and even VIN numbers of vehicles parked on the street. More alarmingly, he could track rental and courtesy cars in real time and remotely unlock vehicles linked to the system. He even had the ability to cancel car shipments to more than 1,000 dealerships across the U.S.

This kind of car hacking vulnerability isn’t new. In January, Subaru faced a similar exposure, raising further concerns about the growing risks of connected car technology.

As Zveare noted, the smarter and more connected vehicles become, the greater the potential for hackers to exploit weak links. Modern car apps already let owners locate, track, and unlock their vehicles remotely—but when that same access falls into the wrong hands, it poses a massive cybersecurity threat to the automotive industry.

This isn’t Zveare’s first big discovery. In 2023, he gained access to Toyota Mexico’s customer data and, shortly before that, infiltrated Toyota’s global supplier management network—a critical system for its supply chain. He later described that flaw as “one of the most severe vulnerabilities I have ever found.”

The silver lining? Zveare responsibly reports all vulnerabilities to companies before going public, giving them time to fix the issues. He first identified the dealership portal exploit in February, and the problem has since been resolved.

Still, his findings highlight a sobering reality: if one researcher can uncover these flaws, malicious hackers may already be exploiting others that remain undiscovered.

So, while you might think locking your car is enough, in the age of connected vehicles and remote access hacks, that may no longer be the case.