Researchers found a serious security vulnerability in Subaru’s Starlink system late last year. It enabled full access to private data including location, emergency contacts, call history, and more. Subaru patched the vulnerability within 24 hours but left broader privacy concerns unresolved.

A Subaru security vulnerability allowed millions of cars to be remotely tracked, unlocked, and started. A full year’s worth

Hackers uncover shocking Subaru flaws, remotely controlling cars and accessing year-long location data—raising major privacy and security concerns.

Two security researchers discovered a security vulnerability in Subaru’s Starlink connected vehicles last year that gave them “unrestricted targeted access to all vehicles and customer accounts” across the U.S., Canada, and Japan, according to a Wired report.

The researchers in this case hacked a test car through a web portal for employees, which not only allowed them to do things like remotely start the car, but also to track the location of the vehicle in real time and see a year’s worth of location data.

Security researchers recently uncovered serious flaws in Subaru's Starlink service, which is available on select 2019 and newer models. These vulnerabilities allowed hackers to remotely control features of affected vehicles,