Toyota, GM, Ford Vehicles Vulnerable to Hacking, Class Action Says

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Toyota Motor Corporation, Ford Motor Company, and General Motors were all hit with a class action lawsuit, alleging that they sold vehicles that are vulnerable to hacking that make the cars unsafe to drive.

“Because Defendants failed to ensure the basic electronic security of their vehicles, anyone can hack into them, take control of the basic functions of the vehicle, and thereby endanger the safety of the driver and others,” plaintiffs Helene Cahen, Kerry Tompulis and Merrill Nisam allege in their class action lawsuit.

“This is because Defendants’ vehicles contain more than 35 separate electronic control units (ECUs), connected through a controller area network (‘CAN’ or ‘CAN bus’),” the class action lawsuit explains.

“Vehicle functionality and safety depend on the functions of these small computers, the most essential of which is how they communicate with one another.”

Cahen is the owner of a 2008 Lexus RX 400 H, made by Toyota, which she says she purchased new. Tompulis owns a 2014 Ford Escape, and Nisam owns a 2013 Chevrolet Volt.

The class action is lawsuit is for owners of Toyota, Lexus, Scion, Ford, Lincoln, Mercury, Buick, Cadillac, Chevrolet, GMC, Hummer, Pontiac, and Saturn vehicles, and included the electronic control units connected through a network, described above as a CAN bus.

According to the vehicle hacking class action lawsuit, a hacker could send its own information via the vehicle’s control units and control the vehicles’ functions including braking, steering and accelerating, taking control of the vehicle away from the driver.

“Disturbingly, as Defendants have known, their CAN bus-equipped vehicles for years have been (and currently are) susceptible to hacking, and their ECUs cannot detect and stop hacker attacks on the CAN buses. For this reason, Defendants’ vehicles are not secure, and are therefore not safe,” the plaintiffs explain in their defective vehicle class action lawsuit.

“Defendants have charged a substantial premium for their CAN bus-equipped vehicles since their rollout,” the plaintiffs allege. However, “these defective vehicles are worth far less than are similar non-defective vehicles, and far less than the defect-free vehicles the Plaintiffs and the other class members bargained for and thought they had received.”

The vehicle hacking class action lawsuit includes research and studies from the University of California, San Diego, the University of Washington and the Defense Advanced Research Projects Agency, which showed that the vehicles systems were vulnerable to hacking.

“In a 2013 DARPA-funded study, two researchers demonstrated their ability to connect a laptop to the CAN bus of a 2010 Toyota Prius and a 2010 Ford Escape using a cable, send commands to different ECUs through the CAN, and thereby control the engine, brakes, steering and other critical vehicle components,” the class action lawsuit explains.

” In their initial tests with a laptop, the researchers were able to cause the cars to suddenly accelerate, turn, kill the brakes, activate the horn, control the headlights, and modify the speedometer and gas gauge readings,” the plaintiffs wrote.

“Before the researchers went public with their 2013 findings, they shared the results with Toyota and Ford in the hopes that the companies would address the identified vulnerabilities. The companies, however, did not.”

The plaintiffs are charging Toyota, Ford and GM in the class action lawsuit with a variety of breach of contract statutes. They are proposing a nationwide class of those who owned or leased Toyota, Ford or GM vehicles. They are also proposing subclasses in all 50 states including the District of Columbia.

The plaintiffs are represented by Matthew J. Zevin, Marc R. Stanley and Martin Woodward of Stanley Law Group.

Counsel information was not immediately available for the automakers.

The Defective Vehicle Class Action Lawsuit is Cahen et al. v. Toyota Motor Corporation et al., Case No. 3:15-cv-01104, in the U.S. District Court for the Northern District of California.

UPDATE: The car hacking class action lawsuit was dismissed on Nov. 25, 2015.

UPDATE 2: On Sept. 30, 2016, Toyota asked a federal appeals court to uphold a trial court’s dismissal of a vehicle hacking class action lawsuit.