News Summary

Tata Motors, a major Indian automotive company, has addressed a series of security vulnerabilities that exposed sensitive internal and customer data. The flaws were discovered within Tata Motors’ E-Dukaan portal, which is used for purchasing spare parts for their vehicles. Security researcher Eaton Zveare identified that the portal’s web source code included private keys granting access to Tata Motors’ Amazon Web Services (AWS) account. This exposure risked hundreds of thousands of invoices containing customer information, MySQL database backups, and other sensitive files. The AWS keys also provided access to over 70 terabytes of data related to Tata Motors’ FleetEdge fleet-tracking software. Additionally, backdoor admin access was found to a Tableau account containing data of over 8,000 users. After reporting the issues to Tata Motors via the Indian computer emergency response team in August 2023, the company confirmed that the vulnerabilities were fixed by October 2023, although it did not specify if affected customers were notified.