Connected car hacking: what modern vehicle infotainment systems expose

Picture this: you hop into a rental car, connect your phone to get directions home, and think nothing of it. But somewhere in that car's system, your name, your contacts, and your home address just got stored. And when the next person rents that car, they may be able to see all of it.

This isn't a hypothetical. It's a documented, recurring problem with connected vehicles, and it points to a much larger issue: modern cars collect a lot of data, and most drivers have no idea what's being recorded, stored, or exposed.

Connected car hacking is no longer a stunt pulled by researchers at security conferences. In 2024, the share of vehicle cyberattacks affecting millions of vehicles at once more than tripled compared to the year before. Your infotainment system is the front door.

Your car knows more than you think

Modern infotainment systems are essentially smartphones bolted into your dashboard. They run full operating systems, connect to Wi-Fi, pair via Bluetooth, sync with cellular networks, and regularly pull in data from the apps you use every day. When you plug your phone in or pair it wirelessly, you're sharing far more than a playlist.

A typical infotainment system can store:

• Your full contact list and call history
• Text message previews
• Home and work addresses from navigation history
• Calendar entries synced from your phone
• App data from connected services
• Saved payment details for parking or toll apps

In one documented case, a cybersecurity professional bought a used car and found the previous owner's home address and credit card number still sitting in the infotainment system, according to reporting by The Record. The original owner had no idea.

Automakers including Chrysler, BMW, Dodge, Mazda, Ford, and Lincoln have been found to be unclear or silent about whether they harvest data from synced phones, according to The Record. Most drivers never read the privacy policies buried in terms and conditions, and even those policies often don't explain what data is actually being collected or where it ends up.

How hackers get in

Most people picture car hackers as someone physically tampering under the hood. The reality is different. According to the 2025 Automotive and Smart Mobility Cybersecurity Report by Upstream Security, 92% of automotive cyberattacks in 2024 were executed remotely, and 85% required no physical proximity to the vehicle at all.

The entry points are the same features that make modern cars convenient:

• Bluetooth: Researchers at PCA Cyber Security discovered four vulnerabilities, collectively named PerfektBlue, in OpenSynergy Blue SDK. This is the Bluetooth software component used in an estimated 350 million vehicles made by Ford, Mercedes-Benz, Skoda, Volkswagen, and others (Kaspersky). According to Kaspersky, a successful attack lets a hacker track the car's location, eavesdrop through its built-in microphones, and steal the driver's contact list. In most cars, the driver has to approve the new connection first, so declining a pairing request you don't recognize stops the attack. Standard Bluetooth hardware limits the attack range to about 33 feet (10 meters), but with signal amplifiers, that extends to roughly 165 to 330 feet (50 to 100 meters).
• Wi-Fi and cellular connections: Many vehicles connect to cloud-based servers for navigation updates, remote start, and over-the-air software patches. If those connections are poorly secured, attackers can intercept the traffic.
• USB ports: Plugging an unknown device into a car's USB port can introduce malicious code directly into the infotainment system.
• Third-party apps: Navigation and streaming apps installed on the infotainment system often carry their own security gaps, and poorly coded apps can open doors into the vehicle's network.

Real attacks, real consequences

In 2024, the automotive industry recorded 409 new cybersecurity incidents, up from 295 in 2023, according to Upstream Security's 2025 report. Incidents affecting millions of vehicles more than tripled, jumping from 5% of all cases in 2023 to 19% in 2024 (Auto Connected Car / Upstream Security). Data and privacy-related incidents made up 60% of all cases, a 20% increase from the prior year (Auto Connected Car / Upstream Security).

One June 2024 ransomware attack targeted a US software provider serving 15,000 automotive dealerships. Operations halted for nearly three weeks. Estimated losses: $1.02 billion.

For individuals, the risks look different but feel just as close. Hackers who gain access to an infotainment system can:

• Pull your home address from saved navigation history
• Clone your phone's contact list
• Intercept calls routed through the car's hands-free system
• Track your real-time location using the car's built-in GPS

If your vehicle uses a connected app for remote start or door unlocking, a compromised account can give an attacker physical access too.

The data your car stores when you sell or trade it in

Selling a car is a data security event most people never prepare for. When you trade in or sell a vehicle, every infotainment system that ever paired with your phone may still hold a copy of your contacts, your frequent destinations, your call logs, and more.

The used car case mentioned above isn't unusual. Researchers and privacy advocates consistently point out that leftover data in resold vehicles is common, largely invisible to the seller, and often accessible to anyone who sits in the driver's seat.

A factory reset is the only reliable way to clear this data before selling. Most automakers bury that option deep in the settings menu, and many drivers don't know it exists. If your car has a companion app, also remove the vehicle from your account and complete the manufacturer's ownership transfer. A factory reset clears the dashboard, but it may not cut off your remote access to features like unlocking and location tracking. If you're buying a used car, it's worth asking whether a full system reset was performed before you take delivery. Don't assume it was. Check the system yourself and confirm the previous owner's app access was removed.

What you can do right now

You don't need to avoid your car's infotainment system entirely. A few deliberate habits make a real difference:

• Don't auto-sync everything. When prompted to share contacts or call history via Bluetooth, decline unless you genuinely need hands-free calling. The system doesn't need your full address book to play music.
• Update your car's firmware. Carmakers push security patches through firmware updates, often distributed through dealerships. Ask your dealer whether your head unit has the latest version installed. The PerfektBlue Bluetooth vulnerability had a patch available from September 2024, but many vehicles may still be waiting for it to be applied.
• Turn off Bluetooth when you're not using it. Switching it off on your phone, and on the car if it has the option, closes off one of the main wireless entry points. It takes three seconds. If your car ever asks you to approve a Bluetooth device you don't recognize, decline it.
• Use power-only USB cables. If you're charging your phone in an unfamiliar vehicle, a charge-only cable prevents data transfer through the port.
• Clear your data before selling or returning a rental. Before selling, do a full factory reset and remove the car from your companion app account. In a rental, delete your phone from the paired devices list before handing back the keys.
• Secure your connected car app. If your vehicle has a companion app for remote start or locking, use a strong, unique password and turn on two-factor authentication, ideally with an authenticator app or passkey rather than SMS codes. A compromised app account is a direct path to your car.

Conclusion

Your car is no longer just a way to get from A to B. It's a networked device that remembers where you've been, who you've called, and what you've saved. That makes it worth treating the same way you'd treat your phone or laptop: with a little attention and a few simple habits.

You can't stop automakers from building connected systems. But you can control what you share, what you delete, and how you stay ahead of the risks. Start with the basics. Keep your firmware updated, don't auto-sync your entire phone, and always reset before you sell.

Your car also connects to the scams that reach you through your phone and browser: fake toll and recall texts, lookalike login pages for your car's companion app, and data breaches that expose the email or phone number tied to your account. Guardio works on your computer and on your iOS or Android phone. It blocks dangerous sites and phishing emails, filters scam texts on iPhone, and alerts you if your information shows up in a data breach. Start for free with Guardio and see where you're exposed.

Get a free security scan with Guardio today and stay protected.