Possible ‘massive’ Tesla data breach probed by European authorities

BERLIN — German authorities have serious indications of possible data protection violations by Tesla Inc., Handelsblatt newspaper reported, citing the data protection office in the state where the carmaker has its European gigafactory.

Tesla has failed to adequately protect data from customers, employees and business partners, Handelsblatt reported, citing 100 gigabytes of confidential data leaked to the newspaper by a whistleblower.

The files include tables containing more than 100,000 names of former and current employees, including the social security number of Tesla CEO Elon Musk, along with private email addresses, phone numbers, salaries of employees, bank details of customers and secret details from production, Handelsblatt reported.

Citing the leaked files, the newspaper reported about thousands of customer complaints regarding the carmaker’s driver assistance systems with around 4,000 complaints on unintended acceleration or phantom braking.

Last month, a Reuters report showed that groups of Tesla employees privately shared via an internal messaging system sometimes highly invasive videos and images recorded by customers’ car cameras between 2019 and 2022.

The data protection office in the German state of Brandenburg, which is home to Tesla’s European factory, described the data leak as “massive.”

“I can’t remember such a scale,” Brandenburg data protection officer Dagmar Hartge said, adding that the case had been handed to the Dutch authorities who would be responsible if the allegations led to an enforcement action.

The data protection watchdog for the Netherlands said on Friday it was aware of possible Tesla data protection breaches, but it was too early to say whether it would start an investigation.

The breach would violate the European Union’s General Data Protection Regulation (GDPR). If such a violation was proved, Tesla could be fined up to 4 percent of its annual sales, which could be 3.26 billion euros.

German union IG Metall said the revelations were “disturbing” and called on Tesla to inform employees about all data protection violations and promote a culture in which staff could raise problems and grievances openly and without fear.

“These revelations … fit with the picture that we have gained in just under two years,” said Dirk Schulze, IG Metall incoming district manager for Berlin, Brandenburg and Saxony.

Tesla was not immediately available for comment on the report.

Handelsblatt quoted a lawyer for Tesla as saying that a “disgruntled former employee” had abused his access as a service technician to get information. The lawyer said the company would take legal action against the suspected ex-employee.

The whistleblower notified the German authorities about the data protection breach in April, according to the newspaper.

This week, Facebook parent Meta was hit with a record 1.2 billion euro ($1.3 billion) fine by its lead European Union privacy regulator over its handling of user information and given five months to stop transferring user data to the U.S.