“These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.”
The way in was Kia’s dealer portal, which handed dealer access to anyone who signed up with ordinary credentials. From a license plate, an attacker got the owner’s name, phone, email and home address, then added himself as an invisible second user. The affected table runs from model year 2014 to 2025. Kia charges for the connected features and gave away the master key for free.