Millions of Kia vehicles were vulnerable to remote attacks with just a license plate number

In June 2024 security researchers found vulnerabilities in the Kia dealer portal that allowed creation of fraudulent dealer accounts, access to customer PII, and reassignment of vehicle primary owners by converting license plates to VINs via a third-party API, enabling remote control of vehicles (lock/unlock, start/stop, locate, honk); the researchers produced a proof-of-concept tool, responsibly disclosed the issues to Kia, and Kia has since remediated the vulnerabilities.