Subaru Starlink flaw let hackers hijack cars in US and Canada

Security researchers disclosed an arbitrary account takeover vulnerability in Subaru's Starlink admin portal that—using only minimal identifiers such as a license plate—could let an attacker access and control vehicles, retrieve precise location history (past year, ~5m accuracy), and extract customer PII and vehicle data across the United States, Canada, and Japan; the issue was demonstrated by researchers, patched by Subaru within 24 hours, and reported as not exploited in the wild.