The researchers in this case hacked a test car through a web portal for employees, which not only allowed them to do things like remotely start the car, but also to track the location of the vehicle in real time and see a year’s worth of location data.

Researchers found a serious security vulnerability in Subaru’s Starlink system late last year. It enabled full access to private data including location, emergency contacts, call history, and more. Subaru patched the vulnerability within 24 hours but left broader privacy concerns unresolved.