Now-fixed web bugs allowed hackers to remotely unlock and start any of millions of Subarus. More disturbingly, they could also access at least a year of cars’ location histories—and Subaru employees still can.

Two security researchers discovered a security vulnerability in Subaru’s Starlink-connected vehicles last year that gave them “unrestricted targeted access to all vehicles and customer accounts” across the U.S., Canada, and Japan, according to a Wired report.

Researchers found a serious security vulnerability in Subaru’s Starlink system late last year. It enabled full access to private data including location, emergency contacts, call history, and more. Subaru patched the vulnerability within 24 hours but left broader privacy concerns unresolved.