Skip to Content
News

Thousands of L.A. Based Electric Car Share Users’ Personal Information Exposed in Data Leak

Blink Mobility, the company that manages the Blue LA electric car share program in partnership with the City of Los Angeles, first learned of the data leak on December 14, according to a notice from Blink Mobility that was reportedly sent to “impacted users" on January 5.

12:04 PM PST on February 7, 2024

via Blink Mobility/X

More than 22,000 Blue LA users had their phone numbers, email addresses, encrypted passwords and other personal information exposed in a data leak last year, according to a report by Cybernews.

A spokesperson for the Los Angeles Department of Transportation (LADOT) confirmed the data leak. "LADOT was informed by the contractor of this issue," Colin Sweeney told L.A. TACO.

Blink Mobility, the company that manages the Blue LA electric car share program in partnership with the City of Los Angeles, first learned of the data leak on December 14, according to a notice from Blink Mobility that was reportedly sent to “impacted users" on January 5.

“On 12/14/2023, Blink Mobility received notice that a former vendor’s database had a vulnerability that may have comprised some customer data.” The database was part of a “legacy system” that had been replaced in August of 2023, the company said.

“We believe that the vulnerability may have comprised data that includes some customer’s phone numbers, email addresses, encrypted passwords, account registration dates, device info, device tokens, and details on subscription and rented vehicles.”

Blink Mobility advised customers to update passwords “on any applications that share the same password as the legacy Blink Mobility app,” even though the data that was exposed was encrypted.

Cybernews first reported on the data leak at the end of last year, after their research team discovered the exposed database through metadata that “was then indexed by search engines.” Their investigation revealed that more than 22,000 users were contained in the database.

Cybernews reported the leak to Blink Mobility the same day they discovered it. A couple of days later, the database was gone, Cybernews reported.

It is unclear if hackers accessed the data before it was taken down.

“Personally identifiable information from car renting companies is highly valued among black-hat hackers and is often sold in batches on cybercrime marketplaces on the dark web,” according to Cybernews.

“In the wrong hands, this data can be exploited for financial gain,” Cybernews researchers said. “Threat actors could potentially use the exposed information to track users’ movements, manipulate booking, and engage in fraudulent activities.”

Twenty-two days after first learning of the data leak, on January 5, Blink Mobility sent a “notice of data breach” to impacted users, according to Colin Sweeney, Director of Public Information for LADOT.

Sweeney did not confirm how many users were impacted by the leak when asked. 

Blink Mobility’s notice informed users of what happened, what information was potentially leaked as well as steps that users should take to protect themselves.

In a request for comment, L.A. TACO asked Blink Mobility why they didn’t immediately notify customers.

“Blink Mobility is committed to providing a secure environment for our customers,” the company’s notice reads. “Our new mobile app launched in August 2023, is fully built and maintained by us. Furthermore, we are expanding our cybersecurity auditing process for partners and third-party vendors.”

Blue LA, in partnership with LADOT, began service in 2018 and was briefly managed by a French company before Blink Mobility took over in late 2020. Through an app, Blue LA users can rent electric Chevy Bolts by the minute. Today there are roughly 40 Blue LA charging stations and 100 vehicles available.

If you’ve had issues with Blue LA, please contact our investigative reporter - LexisOlivier@Gmail.com.

Stay in touch

Sign up for our free newsletter

More from L.A. TACO

Justice 8 Supporters Feel Defeat At Latest Ruling. Enamorado Reported to Be Bleeding While Jailed

Enamorado's attorney alleges, "He is not getting the treatment he deserves for what is a valid medical reason.” Nonetheless, the supporters for The Justice 8 are bracing themselves to keep fighting.

February 20, 2024

West Hollywood’s Outdoor ‘Consumption Lounge’ Is a One-Of-Its-Kind Sneak Peek Into the Future of Dispensaries

Come take a look as the L.A. TACO team tours and enjoys a private tree-house cabana at The Woods dispensary, the only consumption lounge of its kind in L.A. County. It was a great day of "work" we'll never forget.

February 20, 2024

What to Eat This Weekend: ‘Sea-Cuterie,’ Al Pastor Rigatoni, and Oxtail Curry Pizza

Plus, a new spot to get huitlacoche quesadillas—with cheese—in the San Fernando Valley and a new delivery-only bento box to order in.

February 16, 2024

The Nug Report: Lemon Drop by LAX Packs

We found that Lemon Drop pairs well with a cappuccino for an extra jolt and makes for a good “first smoke of the day.” Or, if you have the budget, an afternoon lounging with exotic parrots in the back patio of The WOODS, actor and cannabis OG Woody Harrelson’s consumption lounge.

February 16, 2024

Long Beach’s 100-Year-Old Bar Goes Through More Than 450 Pickled Eggs a Day

"This place is a church, everyone respects this place."

February 16, 2024
See all posts