“Inside the repo there was a hardcoded access key for the data server that manages customer info.”
A Toyota subcontractor pushed T-Connect source code to a public GitHub repo in December 2017. The hardcoded key inside opened data on 296,019 customers. Nobody noticed until September 2022. Toyota says names and card numbers weren’t in there, as if five years of open access to customer IDs and emails is a footnote. Secret scanning is free. Toyota just never looked.