Archive · 29 Oct 2025
Tata Motors Confirms Fixing Major Cybersecurity Flaws Exposing 70TB of Data
Imagine a company like Tata Motors, which makes cars, had a secret code to access its online filing cabinets.
Someone found that this secret code was written down in a public place, and another code, which was supposed to be hidden, could also be easily figured out.
This meant that someone could have looked at or taken about 70 large boxes of secret information.
This information included people's names, addresses, and details about company sales and performance, stretching back many years.
The company has now fixed these secret code problems to keep the information safe, but it took a long time to make sure everything was secure.
Tata Motors confirmed fixing critical cybersecurity flaws that put approximately 70TB of sensitive customer and company data at risk.
The vulnerabilities, reported in August 2023, stemmed from poor key management, including hardcoded AWS access keys in public source code.
Affected systems included the company's e-commerce portal (E-Dukaan) and fleet tracking solution (FleetEdge).
Exposed data included customer personal details, financial reports, and historical vehicle insights dating back to 1996.
While the company states flaws were addressed in 2023, full remediation reportedly concluded in January 2024 after researcher follow-ups.
- Who
- Tata Motors
- What
- Fixed critical cybersecurity vulnerabilities that exposed approximately 70TB of sensitive customer and company data.
- When
- Vulnerabilities reported in August 2023, remediation concluded by January 2024.
- Where
- Across multiple digital platforms including E-Dukaan, FleetEdge, and internal dashboards.
- Why
- Poor key management practices, including hardcoded and easily decryptable AWS access keys, created significant data exposure risks.
- Data at Risk
- Approx. 70TB of customer and company data
- Vulnerability Type
- Poor key management, hardcoded AWS access keys, easily decryptable encrypted keys
- Affected Systems
- E-Dukaan (e-commerce portal), FleetEdge (fleet tracking solution), internal Tableau dashboards
- Compromised Data Types
- Customer invoices, PAN numbers, MySQL backups, private communication logs, historical vehicle insights, financial reports, performance metrics
- Reporting Date
- August 2023
- Remediation Completion
- January 2024