How worried should we be?

[emmrecs]

some are business names, some are just post codes, some are full addresses - they seem genuine.

To verify whether they are genuine wherever they are in the world you could try putting a few of them, one at a time into Google Maps (or similar) and then (in Google maps) use Streetview to check they are genuine.

If even some of them do turn out to be genuine that could well be a cause for concern! (Perhaps having the pre-facelift version of the MG5, so no app, is not such a bad thing after all.

 

[DBedford]

Did you purchase the car from new?
Find it hard to believe data is being transmitted back into the car.

 

[luis]

I will try to google some addresses - will take screenshots tomorrow.

I got the car from new (see profile picture).

The issue only manifested itself after the last update I got some time back to fix the “service every 750 miles” bug. Before that I didn’t have this data leak issue.

It’s very strange, but it is the indeed happening.

I’m happy to provide proof in any way you see fit.

Here's a few examples I just photographed, which seem harmless enough to share.

I took a bunch of pictures and a few videos this morning, scrolling through the enormous list of recent destinations, as well as clearing them all one by one, and only then found the Manage option and cleared everything again, but with a single click. The recent list was then empty.

You can't seem to be able to clear your home address (mine is of course set to somewhere in Germany), so I set that to "London" and also did a single destination to "Brighton" and started a route - so I have just that in my recent destinations.

I will check later/tomorrow to see if/when it resets again.

Screenshot 2023-08-15 at 10.12.01.png

Shared with Dropbox

www.dropbox.com

Screenshot 2023-08-15 at 10.12.42.png

Shared with Dropbox

www.dropbox.com

Screenshot 2023-08-15 at 10.17.00.png

Shared with Dropbox

www.dropbox.com

(attachments seem to have failed so I added dropbox links)

 

[okohll]

That does seem concerning, if it were me I would probably next follow this process -

How to make a data protection complaint to an organisation

You have the right to be confident that organisations handle your personal information responsibly and in line with good practice.

ico.org.uk

even though you're not certain it's personal data, it could be. At least it might make the dealer and/or MG take it a bit more seriously.

 

[AB71]

Headlines in todays paper!

"Ministers are warning that Chinese electric cars imported to the UK will enable Beijing to spy on British citizens"

Is it another of those conspiracy theories?

My Lord they can spy on me if they want but they’ll be bored to death within a day or two

 

[Gadget Geek]

My Lord they can spy on me if they want but they’ll be bored to death within a day or two

Reminds me of Rhod Gilbert's stand up about his trip to Camp Bastion to entertain the troops. He phoned his mother to tell her he'd arrived safely and he was warned about the Taliban listening in . . . his response was hilarious (might be on Youtube).

 

[mystreet]

I could go and look around the CM0 postcode for a MG.
But, the wife will think that I am (more) weird and would I be worrying someone there.

 

[luis]

I could go and look around the CM0 postcode for a MG.
But, the wife will think that I am (more) weird and would I be worrying someone there.

There is another entry further down (on a screenshot I didn’t' share) for that same postcode which is more precise with the street and house number. If you're interested I can give you the full address on that one. It could, of course, be an MG owner, or the destination of a tradesman or delivery person visiting.

But if it's easy for you, and you're up for it, it could help prove a point.

 

[luis]

Update - so far the data hasn't been overwritten in the car (only 2 days) - I'm not really sure how long I need to leave it - I just know that after some time, I'd look at it and it would be filled with more seemingly random addresses.

I'll leave it about a week then check and then try other scenarios (i.e. having no recent destinations - since I rarely use it and that's how I'd normally have it after a full wipe; and also doing a 10-second home-press reset which I do very occasionally when the system crashes - but that could be a factor in the population of data)

If it doesn't happen again, then great, they will have fixed the issue - but I have photo/video proof that my car had a ton of addresses if required.

I have wiped all random addresses around 4 or 5 times so far since the problem started.

 

[OriginalBigAl]

In the "Hello tech heads" video about the differences between the phase 1 and phase 2 MG4s she announces the new long range se version in Germany will have a heat pump. As mine is in France I thought will mine? MG France web page says no, so I tried the relevant web pages for Germany , Australia and my computer is blocked from accessing these pages, it always defaults back to MG France. On my TV with a firestick and VPN I could access MG de. and yes it does announce a heat pump. Why the big secrets , and is my computer being controlled from afar, the 403 restricted access page is getting annoying. Separately I managed to access MG Denmark and ACC is known as Adaptiv fartpilot.

 

[tsedge]

In the "Hello tech heads" video about the differences between the phase 1 and phase 2 MG4s she announces the new long range se version in Germany will have a heat pump. As mine is in France I thought will mine? MG France web page says no, so I tried the relevant web pages for Germany , Australia and my computer is blocked from accessing these pages, it always defaults back to MG France. On my TV with a firestick and VPN I could access MG de. and yes it does announce a heat pump. Why the big secrets , and is my computer being controlled from afar, the 403 restricted access page is getting annoying. Separately I managed to access MG Denmark and ACC is known as Adaptiv fartpilot.

I have adaptive fartpilot on mine too - but only when I am in the car.

 

[johnb80]

Headlines in todays paper!

"Ministers are warning that Chinese electric cars imported to the UK will enable Beijing to spy on British citizens"

Is it another of those conspiracy theories?

Smoke and mirrors, really, what does it matter? I'm not bothered in the slightest if the Chinese find out I drive to Morrisons in Gains bough at 09:27 every Friday.

 

[evcog]

This needs to be raised with Information Commisioners Office. Especially if you have already tried to resolve the issue with the supplier (and MG?). I would inform MG if not already done but say you will raise the issue with the ICO. This should get some movement if it has not been taken up the chain of command within MG.

It is a very serious data breach if these are real addresses that identify locations where expensive cars may be parked. If its available to you it probably is available to others.

Quite worrying if it turns out to identify individuals.

 

[luis]

I’ll wait till it happens again.
I’m pretty sure they are real addresses as they vary in level of accuracy - sometimes full address, sometimes postcode. There’s an MG dealer there - but also a Nissan dealer.

The moment it happens again I’ll take things further.

If it doesn’t happen again - then it’s fixed, which is great. But if these are real destinations, then the data is being transmitted and stored in servers - and bizarrely can also be transmitted to cars.

If my car is/was in a demo mode, then that’s more reassuring - though it would be nice to switch that off.

In the past, I set my home address, cleared all random recent destinations and had it all overwritten at least twice.

I mentioned it in my last software update and again during the 1st year service a month ago.

I’m going to wait and see if it happens again.

 

[johnb80]

That does seem concerning, if it were me I would probably next follow this process -

I dont see why it a concern, jump onto google maps and streetview, you can see it all. What value is this data to anyone? I picked one of the postcodes from the screenshots.

I accept it would be better if it didnt happen but I wont be losing any sleep over it at all.

 

[evcog]

I dont see why it a concern, jump onto google maps and streetview, you can see it all. What value is this data to anyone? I picked one of the postcodes from the screenshots.

View attachment 19635
I accept it would be better if it didnt happen but I wont be losing any sleep over it at all.

Unfortunately its still clearly a data breach as it could identify a home location where your car could be located. An expensive car, must have lots of money, we know they drive an MG easy to identify once there.

Simply it may be nothing other than fake data for demo purposes as the poster has intimated. However, the Data Commissioner I think would take a very dim view if its real data.

Still I like you will not lose any sleep over it.

 

[Rolfe]

Houses can be seen from the road. Lots of people park their car in the drive. A quick stroll through any development of detached houses will quickly identify any number of expensive houses with expensive cars, must have lots of money. Nobody needs to get addresses from a random car malfunction if they're planning larceny.

 

[okohll]

No it's not the most egregious data breach I've ever heard of but still, in the larger scheme of things, if a company has internal processes which allow customer data of any sort to be sent to other customers, then it's a sign that data security in general might not be the highest priority. If they are investigated, that's pressure for them to tighten up their processes hopefully before more significant problems come to light. As an MG customer I'd want that to happen.

Although we don't know it's that, it can't hurt if the ICO were to have a look.

 

[Gomev]

Did you purchase the car from new?
Find it hard to believe data is being transmitted back into the car.

That could be handy maybe for over the air updates.................

 

[tsedge]

That could be handy maybe for over the air updates.................

Yeah, maybe the idea was to update us - rather than the car - all along by sharing personal data from others?