There are probably few Beatles songs more appropriate for a cybersecurity article about cars than Drive My Car.
The timing is rather good too. On 2 October, Rubber Soul is being re-released in a new special edition, bringing one of the Beatles’ best-known albums back into the spotlight. And somewhere in the middle of it is that wonderfully simple invitation: “Baby, you can drive my car.”
Well, apparently you can drive someone else’s too. At least, that’s the sort of possibility that starts to emerge when millions of driving licences are reportedly being traded on the dark web.
The licence problem
In early September, the FBI confirmed it was investigating reports that tens of millions of US and Canadian driving licences were being offered for sale on a cybercrime marketplace.
The scale of the alleged breach is extraordinary. Cybersecurity journalist Brian Krebs reported finding a dark web service offering digital scans of more than 150 million driving licences, alongside other identity documents. He was able to verify a number of the records, including his own, before the marketplace disappeared. The FBI has confirmed that it is investigating, although the source of the stolen data has not been established.
At first glance, this might look like another huge identity-theft story. And it is.
But there is a slightly more unusual angle here.
A driving licence is not simply proof that someone is legally entitled to drive. It is one of the most widely accepted forms of identity. It can be used to prove who you are, verify an account, hire a vehicle, access services and, increasingly, connect you to a digital ecosystem around the vehicle itself.
That makes stolen driving licences rather more valuable to cyber criminals than simply a collection of names and addresses. And it raises an awkward question for an industry becoming increasingly dependent on digital identity: who actually has the keys?
The car isn’t just a car anymore.
For most of the history of the motor car, cybersecurity wasn’t really something a driver needed to think about.
You locked the doors. You had a key. Perhaps you fitted an alarm if you were feeling particularly security conscious.
That world has changed.
Modern vehicles are increasingly computers on wheels. They contain multiple electronic control units, wireless communications, sensors, software, cameras and connectivity. They communicate with smartphones, manufacturers’ systems, dealerships, insurers, charging networks and other services.
Some can be unlocked from an app. Some can receive software updates remotely. Electric vehicles can connect to charging infrastructure and payment systems. Fleet operators can monitor vehicles remotely. Manufacturers increasingly rely on cloud-based platforms to provide services that once involved nothing more sophisticated than turning a key.
Convenience has increased enormously. So has the attack surface, and this isn’t a theoretical concern.
The FBI was warning about vehicle hacking a decade ago, pointing out that connections between wireless communications, diagnostic ports and vehicle systems could create opportunities for remote attacks.
The technology has moved on considerably since then and so has the threat, with the numbers moving in the wrong direction
Research from PCA Cyber Security makes uncomfortable reading for the automotive industry.
Its analysis of the second quarter of 2026 identified 345 unique automotive vulnerabilities. Of those, 161 were classified as high severity, compared with 75 in the first quarter. Even more concerning, 94% of the vulnerabilities identified involved low attack complexity, meaning they did not necessarily require sophisticated tools or lengthy preparation to exploit.
The important point is that the problem isn’t simply about someone finding a clever way to steal a particular car.
The automotive attack surface is spreading.
PCA identified vulnerabilities affecting vehicle systems, but also highlighted risks around charging networks, mobility platforms and supply chains. It described examples where weaknesses in cloud-based authentication systems could affect connected charging infrastructure and other mobility services. That changes the nature of the problem.
If an attacker can compromise a system that talks to thousands of vehicles, the potential impact is very different from compromising one vehicle. And then there is the supply chain, with the automotive industry built around interconnected organisations.
Manufacturers rely on component suppliers. Suppliers rely on software providers. Dealers and fleet operators use third-party platforms. Vehicles communicate with external services. Charging infrastructure connects cars to networks. Data flows between organisations that drivers may never even know exist.
That creates efficiency but it also creates dependency.
PCA’s Q2 research found evidence that attackers are increasingly looking beyond the major manufacturers themselves and towards suppliers and other organisations within the automotive ecosystem. A breach in one part of that chain can expose information, disrupt operations or potentially provide a route towards other organisations.
We have seen versions of this story before. There have been reported incidents involving automotive customer data being offered on cybercrime marketplaces, ransomware attacks affecting vehicle manufacturers and suppliers, and vulnerabilities in connected vehicle systems that could potentially be exploited remotely.
Individually, these stories can look like isolated incidents, but taken together, they suggest something else.
The automotive sector is becoming a much larger and more attractive cyber target precisely because the modern vehicle is no longer an isolated machine. The identity problem is coming along for the ride.
Which brings us back to those driving licences.
The potential value of stolen identity data isn’t simply that somebody might use your name or photograph. It is that identity has become increasingly intertwined with digital services.
If a company uses a driving licence to verify who you are, that licence becomes part of the security boundary.
If that identity is then used to access a vehicle, hire a vehicle, manage a fleet, activate a service or gain access to an account, the consequences of compromised identity become rather more interesting.
And this is where automotive cybersecurity starts to overlap with a much broader cybersecurity problem. We don’t just have to secure the car. We have to secure everything that knows the car, controls the car, services the car or proves who is allowed to use it. That’s a much bigger job.
The connected car creates connected risk and there is a temptation to think of automotive cybersecurity as a problem for car manufacturers. It isn’t.
Manufacturers obviously have a huge responsibility. But the modern automotive ecosystem stretches much further. There are software developers, component manufacturers, dealerships, insurers, fleet operators, charging providers, mobility platforms and technology companies. There are also millions of drivers using apps and online services without necessarily knowing how much infrastructure sits behind the screen on their phone.
Every new connection creates another potential point of failure, but that doesn’t mean connected vehicles are a bad idea. Quite the opposite. Connectivity can make vehicles safer, more efficient and considerably more useful, whether through driver assistance, remote diagnostics, over-the-air updates or the growing range of services built around the modern vehicle. The challenge is making sure security keeps pace with that connectivity, rather than being bolted on afterwards.
The uncomfortable bit
Perhaps the strangest thing about this story is that the stolen driving licences and vehicle vulnerabilities might initially seem like two completely different cybersecurity problems. In reality, both are symptoms of the same change: we are taking things that were once physical and relatively self-contained and turning them into connected digital systems.
A driving licence is becoming a form of digital identity. A car is increasingly a software platform, while the traditional car key can now be an app on your phone. Charging points have become networked services, and the data generated by a vehicle has become another valuable digital asset. The more we connect these things, the more important it becomes to understand not just what we’re connecting, but what could happen if one of those connections is compromised.
So, who has your licence?
The automotive industry has spent years making cars more connected. The next challenge is making sure that connectivity doesn’t become the industry’s biggest weakness. The numbers suggest the pressure is already increasing: automotive vulnerabilities are rising, many can be exploited without particularly sophisticated techniques, and attackers are looking beyond individual vehicles towards the wider ecosystem of suppliers, platforms and connected services.
The answer isn’t to go backwards. Nobody is seriously suggesting that we return to cars with no software, no connectivity and a physical key that can be lost down the back of the sofa. The benefits of connected vehicles are too significant for that. What needs to change is how we think about security. A connected car is part of a much larger technology environment, so protecting it means understanding the systems, identities, data and connections that sit around it and what happens when one of them is compromised.
Because the next time you hear someone sing: “Baby, you can drive my car.”
It might be worth asking a rather more important question – who else has the keys?
“Drive My Car” words and music by Paul McCartney and John Lennon ©1965 Sony/ATV Music Publishing LLC. All rights reserved.
Comments are closed.