We take the issue of Toyota and Lexus vehicle theft very seriously. We are continuously developing technical solutions to make our vehicles more secure, to help reduce the risk of theft.
An enhanced security hardware system was introduced in October 2021 (Lexus) and October 2022 (Toyota) on the latest models targeted by criminals. Since which, we have seen a significant drop in thefts of those models.
For older models, we endeavour to create solutions that can offer enhanced protection to our customers. Following significant investments by Toyota GB, in line with that of other vehicle manufacturers, newly developed official Toyota and Lexus security hardware components will very soon be available to fit to those targeted models registered before October 2021.
Following communication from Toyota and Lexus in the coming weeks, owners should contact their local dealer to arrange fitment. Customers can already speak to their local dealer about the fitment of a protective plate to block access to the vehicle’s electronics. This is a nationwide customer care offering available on Toyota RAV4 Hybrid, Lexus RX and Lexus NX.
As a vehicle manufacturer, we can never completely eliminate the risk of vehicle theft. This is an industry-wide issue, concerning all vehicle manufacturers and affecting the most popular models first.
In order to further reduce the theft risk, we regularly collaborate and share information with insurance associations, police and law enforcement authorities, theft prevention experts and other key stakeholders around the world. This enables us to understand new threats and techniques used by thieves and develop more secured systems.
Alongside our efforts, we urge those authorities to focus on reducing the number of thefts. We would also like to see action taken that leads to the end to the online sale of devices used by criminals to steal cars without using the car keys, as these devices serve no purpose other than a criminal one.
How do thieves manage to steal cars in this manner?
The thieves disconnect part of the headlamp and use a malicious device to send signals to the control CAN bus (the communication ‘backbone’ within a car) that allow the doors to open and the car to start without the key or remote control.
Thieves need to:
- Purchase a relatively expensive rogue device (third-party ‘emergency start‘ device which costs around £2500 – £4000 each)
- Gain physical access to the vehicle’s CAN bus communication wires for an uninterrupted period.
The third-party ‘emergency start‘ device has the capability to initiate an exploit in the following manner:
- Once connected to the vehicle’s CAN bus communication wires, the third-party ‘emergency start‘ device can send a prioritised series of CAN signals to bypass the vehicle’s security and immobiliser systems, which could allow a thief to unlock the doors and turn the vehicle’s ignition ON.
- The third-party ‘emergency start’ device is then disconnected.
- At this point a thief can enter the vehicle and start the car without the key.
What is Toyota doing to prevent these types of attacks?
Toyota and Lexus take the issue of car theft very seriously. We are continuously developing technical solutions to make our vehicles more secure to help reduce the risk of theft.
In fact, in the UK market, an enhanced security hardware was introduced in October 2021 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
We cannot divulge the precise nature of the imminent security enhancement; should we do so we risk offering information into the public domain that could be of interest to criminal parties.
The intention is to make the security enhancement available to vehicles affected by CAN bus theft.
What models are known to be targeted by this issue and are newer models affected?
The models primarily targeted are fourth-generation Lexus RX and the Toyota RAV4.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
Since October 2022, Toyota models are subject to a platform change that negates CAN Bus theft. This excludes Hilux, which is not subject to CAN bus attacks.
When did Toyota first become aware of the vulnerability in the security systems?
It is not so much vulnerability of the security systems but more so the growing rise in criminal gangs targeting vehicles for ‘cannibalisation’ and/or complete theft.
Instances appear to have been rising significantly from 2019-2020.
There are many factors involved and at a global level. This includes parts of the world experiencing parts shortage which results in targeted thefts to supply vehicles and/or parts sent to countries experiencing trade restrictions.
Which models can be fitted with the enhanced security feature?
It can be fitted to Land Cruiser 150, RAV4 and first-generation Toyota C-HR.
When is the enhanced security upgrade going to be available and will it be free of charge?
Exact timings are still to be confirmed. We anticipate being able to advise the Toyota Centre network with full details soon. The security enhancement needs to be carried out at a Toyota Centre. Costs are under review; customers may incur a nominal charge.
Are any new models targeted by thieves?
While no car can be considered 100% immune to criminal intent, more recent models are equipped with enhanced security systems aimed at deterring CAN bus type thefts.
Given that the rise in this type or car theft has been known for several years in other countries and is growing in the UK why wasn’t I told about this?
Toyota takes the issue of car crime very seriously. To protect customers’ vehicles our approach is not to disclose our vehicle theft analysis data. The sharing of information could enable thieves to find ways to circumvent anti–theft technologies or make some models particularly attractive to some thieves and unnecessarily vulnerable to attack.
Is a Vehicle Protection Plate (VPP) available for any Toyota models?
Yes, for RAV4, excluding the Plug-In Hybrid model (which is not susceptible to CAN bus attack). The fitment is chargeable.
What is the countermeasure and what’s the plan moving forwards?
We are continuously developing technical solutions to make our vehicles more secure and reduce the risk of theft. An enhanced security hardware was introduced in October 2022 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
Why is there no recall for vehicles susceptible to the CAN bus attack?
Recall announcements in the UK are guided by very specific guidelines as drawn up by the Driver and Vehicle Standards Agency (DVSA). To qualify as a recall, the issue must relate to a safety or thermal type issue where there is potential for injury as a result of vehicle manufacture or component failure. Only in these such circumstances can a recall be announced. In recall circumstances, the DVSA will provide manufacturers access to ownership records for purpose of communication. Instances of theft do not trigger a recall.
Will Toyota pay for damage caused by an attempted theft?
No. This will need to be addressed by the customer and the vehicle insurers. While we understand theft or attempted theft can be highly upsetting and, in some cases, a costly experience, in such instances customers are first and foremost victims of crime. Toyota does not cover costs associated with criminal activity either under the terms of the warranty or as goodwill.
What is the position with insuring affected models?
As a manufacturer, we stay close to Toyota Insurance colleagues and indeed all motor insurers. We are aware that in many cases, insurance premiums might have increased as a direct result of vehicle crime. We need to refer you to your insurer for further comment.
The fact that a front bumber can be forcibly pulled off to gain access to the headlamp connection without the onboard alarm sounding is a manufacturing failure!
This is simply negligence and should therefore be rectified free of charge by Toyota! It’s as simple as that.
If you want proof I have a video of my vehicle ring stolen in this manner in less than 60 secs!
Are you able to confirm if the Highlander is at risk of a canbus theft? I am looking to buy one but this model was not mentioned, unsure if this is because it is not at risk or that there is such a very low number on the road that it is unmeasured. Thanks.
Hi Reece, thanks for getting in touch.
The Highlander is not deemed at risk of CANbus theft due to the platform it is built on.
Thanks,
Toyota UK
Hi Juan, thanks for getting in touch.
We’re really sorry to hear this. Have you discussed the appointment with the service manager at the dealership?
If you’d like us to get in touch on your behalf, please confirm which Toyota Centre it is and your contact details. We won’t publish your response, but will escalate the request internally.
Thanks,
Toyota UK
Hi,
I have just purchased a 2021 Toyota RAV4 AWD from Vantage Toyota Wakefield. I noted this security issue and enquired today about the fitting of the security plate to protect my car. Your bulletin of 13th March indicates that after purchasing the plate “customers may incur a nominal charge” for fitting.
The nominal charge I have been quoted is £228 including VAT.
Could you please confirm that this is correct as some owners are paying £70 for the part and fitting at some dealers?
Kind regards
Nigel
Hi Nigel, thanks for getting in touch.
Please may you confirm your registration number so we can look into this for you, also if it is ok to contact you via the email address you have used here.
Thanks,
Toyota UK
My new Toyota Hilux was stolen early Monday morning the 24th of June 2024.
My car was parked in a secure car park 20m from the hotel entrance at the Premier Inn Excel London Docklands, the car park is fitted with at least 5 security cameras and a security patrol vehicle patrolling the site.
I am shocked that under these circumstances thieves can steal my car without any indication of the theft in such a high-security location.
It begs the question if they need to remove the bumper and headlight to gain access and override the security controls before driving off.
Hi John, thanks for your comment.
We’re so sorry to hear that your Hilux has been a victim of CANbus theft. Sadly thieves are so determined, there is no solution that can ensure the complete safety of the vehicle.
We are working on further security enhancements and hope to have more information on this soon.
Thanks,
Toyota UK
Hi
Thanks for your reply,
Your current news article dated the 13th of March 2024, states ‘Since October 2022, Toyota models are subject to a platform change that negates CAN Bus theft. This excludes Hilux, which is not subject to CAN bus attacks.’
Please identify if your current assessment and publication, that the Toyota Hilux is ‘not subject to CAN bus attacks’, is accurate or if the Hilux is also susceptible to this form of theft.
If the Hilux is not susceptible to this form of CAN bus theft then it can only be concluded that your current security control system has been compromised which allows the theft of the vehicle without any removal of the bumper or headlamp.
Why was I not notified of this by the dealer during the vehicle purchase which was completed in May 2024?
I consider this a direct violation of my consumer rights, as you are still promoting and selling equipment which is not fit for purpose and you are not informing clients of this inherent risk when purchasing your product.
If I had been made aware before purchase, that there was a failure of your basic security system for the Hilux, I could have opted for increased security to mitigate this risk or chosen not to purchase this type of vehicle.
I have not been given this basic information to make an informed decision during my purchase and consider this a direct violation of the Consumer Rights Act.
Hi John, thanks for getting in touch.
The Hilux isn’t at risk of CANbus theft, but may be a target for other theft methods. We are working on further security enhancements that will address a multitude of theft methods and hope to have further information available soon.
Thanks,
Toyota UK
I bought a C-HR sport and it was stolen, I believed it was because I did not have a faraday pouch at a time. I loved the car so I bought another with my insurance payout from a Toyota dealer, telling them that it had been stolen. My newer C-HR DC21 *** has since had two attempted CANBUS attacks. Not once did your Toyota centre staff mention that this is a possibility in this car after I had explained my car had been taken. My current car is fitted with a steering lock and I vigilantly keep my key fob in a pouch. The first time it happened I took it to Enfield Jemca Toyota and they quoted £9000 to ‘repair’ (rather just replace parts and scam insurers) the headlight and body work they damaged as well as a nominal £125 charge just to look at it. The second time I took it to my local garage who fixed it for £85 – much cheaper but still expenses from my pocket. I will be selling this car and never buying another Toyota unless this is addressed promptly by Toyota. 3 month wait for an ‘update’ isn’t good enough.
Hi Lucy, thanks for getting in touch.
We’re so sorry to hear that your Toyota C-HR has been a target of theft. We are currently working on further security enhancements and hope to have more information to share soon.
Thanks,
Toyota UK
It looks like Toyota have a fix for the key reprogramming used by car thief back in March 2024, but I’m guessing they need to update all their systems and dealers and training and authentication etc.
Basically they’ve added the requirement that an encryption key is sent from Toyota (with approval from dealer management) to pass to the car to enable the reprogramming of the key fobs.
I’m assuming this will be a free update as the car security is not fit for purpose.
Hi
Im planning to get a delivery of Rav4 from Toyota (Used Approved) on this week form Toyota agency.
Its a 2016 plate Patrol.
Is this Rav4 subject to this threat ?
Hi Supun, thanks for your comment.
This RAV4 would not be subject to CANbus theft due to the age of the vehicle.
Thanks,
Toyota UK
Thanks , bit relieved
Hi toyota uk my brand new corolla gr sport estate was stolen monday they broke into house to obtain keys, the vehicle tracking data is not live and thieves are clearly using jammers as last location is always wrong as police has visited site but data clearly is incorrect as vehicle is not there, obviously police have been notified. Have toyota access to more data? I’m in uk.
Hi there, thanks for your comment.
We’re so sorry to hear that your Corolla has been a victim of vehicle theft. Whilst the MyToyota app does show vehicle location, it is not a live tracker and will not be able to be used to locate the vehicle.
Thanks,
Toyota UK
My Rav4 2019 plate was stolen from my driveway in May 2024. It took them less than 2 minutes. At the time I did not realise Rav4’s were falling under the high theft category. Its only when I started to read more about car thefts, did I learn its in the top category and how easy it is to steal them. What has annoyed me the most is, Toyota is aware of the issues and have for a long time but yet as there customer they did not warn me. I get no cars are safe out there, but the thieves did not have to break sweat to steal my car. Within 2 minutes they were in and gone. Toyota is now saying they will charge to have all this things fitted to prevent CAN bus thefts etc. Surely its a manufacturing fault and you should protect your customers and recall those cars to install all the security enhancments etc. Which idiot thought of putting a fuse system under the headlamp. I have lost all the trust in the brand, because what i have had to go through the since the car was stolen and still am. No car, dealing with the police, insurance, having to borrow cars just so that i can get to work. I dont think you understand what I have had to go through. Everyday I ask why did Toyota not warn me, its there duty of care if they are aware of the issue to let the customer know. Could have picked up the phone to me and told me, my car falls in the category of high theft and how they can support to prevent it from being stolen. What did they do, nothing. What have they done since then, found a plate which they will charge the customers. Customers who bought the cars, bought it with the trust that Toyota will look after them. Not this case.
Hi Arv, thanks for your message.
We’re so sorry to hear that your RAV4 has been a victim of CANbus theft. We are currently working on further security enhancements and hope to have an update soon.
Thanks,
Toyota UK
Surely the locking mechanism is not fit for purpose as the car can easily be stolen ?
According to the sale of goods / consumer protection should be resolved FREE of charge by the manufacturer.
—
Steve
Hi.
Is there any other security update on the way besides the protection plate for RAV4 models made before October 2022, or not yet?
Hi Nely, thanks for getting in touch.
There are no further updates available at the moment, it is something that we are working on.
Thanks,
Toyota UK
Hi,
Ive just reserved a toyota rav 4 excel, 2021 plate.
Is this model at risk?
I didnt know there was such an issue with theft. It is worrying. I may cancel my deposit and look elsewhere.
Thanks
Hi James, thanks for getting in touch.
Yes, this model will be deemed as at risk of CANbus theft. Vehicle Protection Plates are available for this model and we are also looking into further security precautions.
Thanks,
Toyota UK
My 2020 RAV4 is being serviced at FRF Swansea on the 17th. I’ve asked for the protection plates to be fitted & have referenced this article. They’ve told me the parts are free but quoted £169 to fit. The people on theToyota owners club forum seem to think the cost to fit is £70.
What does the official TSB say?
Thanks, Clare
Hello Clare,
Our Customer Relations team would be best placed to investigate this further for you.
Please email cr@toyota.co.uk with more information on this.
Thank you.
I was told by Toyota the parts are free and £70 to fit. they wouldn’t say what they were or how they prevent car being stolen so imo not really solution just PR.
Also if a plate what happens if dealer can’t access during servicing / repair ?
My dealer quoted £360 to fit !!!
Give me the plate(s) and I’ll fit myself !
The plate won’t fix the underlying issue which is the can vulnerability which needs to have a s/w update.
Surely the locking mechanism is not fit for purpose as the car can easily be stolen ?
According to the sale of goods / consumer protection should be resolved FREE of charge by the manufacturer.
Toyota do the right thing and fix properly and RECALL vulnerable cars.
I’m paying £300 more last two insurance years, I guess I know why now .
The more advance CAN jammers that can be fitted aren’t the solution wither as they only have to figure out where fitted and remove them.
Anywhere the CANbus can be accessed is a vulnerable point.
Unless the protection plate has a physical lock and key and not just tamper screws it’s only a delay.
And if they can’t access these easy CANbus location they’ll go elsewhere.
—
Steve
Hi Steve, we’re very sorry to hear this.
Please could you confirm your registration number and which dealership advised this, also if we are ok to contact you via the email address you have used here.
Thanks,
Toyota UK