We take the issue of Toyota and Lexus vehicle theft very seriously. We are continuously developing technical solutions to make our vehicles more secure, to help reduce the risk of theft.
An enhanced security hardware system was introduced in October 2021 (Lexus) and October 2022 (Toyota) on the latest models targeted by criminals. Since which, we have seen a significant drop in thefts of those models.
For older models, we endeavour to create solutions that can offer enhanced protection to our customers. Following significant investments by Toyota GB, in line with that of other vehicle manufacturers, newly developed official Toyota and Lexus security hardware components will very soon be available to fit to those targeted models registered before October 2021.
Following communication from Toyota and Lexus in the coming weeks, owners should contact their local dealer to arrange fitment. Customers can already speak to their local dealer about the fitment of a protective plate to block access to the vehicle’s electronics. This is a nationwide customer care offering available on Toyota RAV4 Hybrid, Lexus RX and Lexus NX.
As a vehicle manufacturer, we can never completely eliminate the risk of vehicle theft. This is an industry-wide issue, concerning all vehicle manufacturers and affecting the most popular models first.
In order to further reduce the theft risk, we regularly collaborate and share information with insurance associations, police and law enforcement authorities, theft prevention experts and other key stakeholders around the world. This enables us to understand new threats and techniques used by thieves and develop more secured systems.
Alongside our efforts, we urge those authorities to focus on reducing the number of thefts. We would also like to see action taken that leads to the end to the online sale of devices used by criminals to steal cars without using the car keys, as these devices serve no purpose other than a criminal one.
How do thieves manage to steal cars in this manner?
The thieves disconnect part of the headlamp and use a malicious device to send signals to the control CAN bus (the communication ‘backbone’ within a car) that allow the doors to open and the car to start without the key or remote control.
Thieves need to:
- Purchase a relatively expensive rogue device (third-party ‘emergency start‘ device which costs around £2500 – £4000 each)
- Gain physical access to the vehicle’s CAN bus communication wires for an uninterrupted period.
The third-party ‘emergency start‘ device has the capability to initiate an exploit in the following manner:
- Once connected to the vehicle’s CAN bus communication wires, the third-party ‘emergency start‘ device can send a prioritised series of CAN signals to bypass the vehicle’s security and immobiliser systems, which could allow a thief to unlock the doors and turn the vehicle’s ignition ON.
- The third-party ‘emergency start’ device is then disconnected.
- At this point a thief can enter the vehicle and start the car without the key.
What is Toyota doing to prevent these types of attacks?
Toyota and Lexus take the issue of car theft very seriously. We are continuously developing technical solutions to make our vehicles more secure to help reduce the risk of theft.
In fact, in the UK market, an enhanced security hardware was introduced in October 2021 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
We cannot divulge the precise nature of the imminent security enhancement; should we do so we risk offering information into the public domain that could be of interest to criminal parties.
The intention is to make the security enhancement available to vehicles affected by CAN bus theft.
What models are known to be targeted by this issue and are newer models affected?
The models primarily targeted are fourth-generation Lexus RX and the Toyota RAV4.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
Since October 2022, Toyota models are subject to a platform change that negates CAN Bus theft. This excludes Hilux, which is not subject to CAN bus attacks.
When did Toyota first become aware of the vulnerability in the security systems?
It is not so much vulnerability of the security systems but more so the growing rise in criminal gangs targeting vehicles for ‘cannibalisation’ and/or complete theft.
Instances appear to have been rising significantly from 2019-2020.
There are many factors involved and at a global level. This includes parts of the world experiencing parts shortage which results in targeted thefts to supply vehicles and/or parts sent to countries experiencing trade restrictions.
Which models can be fitted with the enhanced security feature?
It can be fitted to Land Cruiser 150, RAV4 and first-generation Toyota C-HR.
When is the enhanced security upgrade going to be available and will it be free of charge?
Exact timings are still to be confirmed. We anticipate being able to advise the Toyota Centre network with full details soon. The security enhancement needs to be carried out at a Toyota Centre. Costs are under review; customers may incur a nominal charge.
Are any new models targeted by thieves?
While no car can be considered 100% immune to criminal intent, more recent models are equipped with enhanced security systems aimed at deterring CAN bus type thefts.
Given that the rise in this type or car theft has been known for several years in other countries and is growing in the UK why wasn’t I told about this?
Toyota takes the issue of car crime very seriously. To protect customers’ vehicles our approach is not to disclose our vehicle theft analysis data. The sharing of information could enable thieves to find ways to circumvent anti–theft technologies or make some models particularly attractive to some thieves and unnecessarily vulnerable to attack.
Is a Vehicle Protection Plate (VPP) available for any Toyota models?
Yes, for RAV4, excluding the Plug-In Hybrid model (which is not susceptible to CAN bus attack). The fitment is chargeable.
What is the countermeasure and what’s the plan moving forwards?
We are continuously developing technical solutions to make our vehicles more secure and reduce the risk of theft. An enhanced security hardware was introduced in October 2022 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
Why is there no recall for vehicles susceptible to the CAN bus attack?
Recall announcements in the UK are guided by very specific guidelines as drawn up by the Driver and Vehicle Standards Agency (DVSA). To qualify as a recall, the issue must relate to a safety or thermal type issue where there is potential for injury as a result of vehicle manufacture or component failure. Only in these such circumstances can a recall be announced. In recall circumstances, the DVSA will provide manufacturers access to ownership records for purpose of communication. Instances of theft do not trigger a recall.
Will Toyota pay for damage caused by an attempted theft?
No. This will need to be addressed by the customer and the vehicle insurers. While we understand theft or attempted theft can be highly upsetting and, in some cases, a costly experience, in such instances customers are first and foremost victims of crime. Toyota does not cover costs associated with criminal activity either under the terms of the warranty or as goodwill.
What is the position with insuring affected models?
As a manufacturer, we stay close to Toyota Insurance colleagues and indeed all motor insurers. We are aware that in many cases, insurance premiums might have increased as a direct result of vehicle crime. We need to refer you to your insurer for further comment.
I’m picking up a new to me Rav 4 registered march 22. I had already paid for the can bus plates on my 2020 px rav and asked the question at Vantage Knaresborough if this 22 plate was effected by this type of theft. They didn’t have a clue. How can they sell on vehicles without fitting these plates as mandatory? They also didn’t know how to put the remote key fob to sleep. Should really educate your dealers as they’re representing your brand.
Hi Stephen, thanks for getting in touch.
We’re really sorry to hear this. Your new RAV4 will be at risk of CANbus theft and eligible for the vehicle protection plate fitting. If you wouldn’t mind confirming your registration number, we’ll pass a note over to the team at Vantage Knaresborough.
Thanks,
Toyota UK
My Toyota rav 4 2919 got stollen June 3,2024 after service and mot done few weeks by totyota sidcup . Jeys are totally secured in box with rfid and in a alluimun box on top still the manage to steal , Your imobizer did not wiork also. Really upset coz a expensive car like this got poor security features now thinking if i’ll still purchase a toyota in the future
How does the protection plate (on headlamp assembly I assume) prevent relay attack to open vehicle and then adding a new key from within the vehicle ?
I saw a video where the relay attack was used to gain access to the car and then a new key fob was added to the car and they had to go through a process moving the relay transmitter in and out of the car to simulate moving they key to the start button and away.
I’ve also seen re-programmers on ebay, just search for:
Car Smart Key Programmer Remote Immobiliser Reset All Keys Lost Tool for Toyota
imo only a software upgrade can address the issue as physical plates only delay access to the canbus as anywhere the wires can be accessed access to the canbus is feasible.
Breaking a window to gain access inside the car and popping the bonnet give easy access to the engine compartment for the cost of a new window.
Having worked on security devices (hardware & software) for over 35 years I understand the weaknesses.
btw: It’s OK to contact me …
Hi Steve, thanks for your comment.
We can see that you have been in touch with our Customer Relations team who are currently looking into this for you. The reference number is CASE2033361 and they are best contacted at cr@toyota.co.uk.
Thanks,
Toyota UK
Hi,
My 2019 RAV4 is in FRF Toyota Swansea and they have quoted me £162 to fit these plates, which they have confirmed are free.
Is this the “nominal” figure you mention above?
Hi Rod, we’re really sorry to hear that.
Would you mind emailing us at cr@toyota.co.uk with this information so we can take a closer look.
Thanks,
Toyota UK
Is the 2016 Land Cruiser 150 at risk? If it is, will Toyota fit a plate for free?
Hi Steve, thanks for getting in touch.
We will need your registration number to confirm this.
Thanks,
Toyota UK
Thanks for your reply. Reg is **** ***
Hey Steve,
We can confirm that your Land Cruiser is not at risk due to the age of your vehicle.
We hope this helps!
Thanks.
Dear Toyota Team, I have been closely following the statement released earlier this year, which follows a TV broadcast covered by BBC One in March. I have noticed multiple changes in the article without any track record of what was changed and why. It should not be permitted to change the content of a public statement, especially one that affects and causes distress to many loyal Toyota group customers.
1. Could you please provide detailed information about the changes made to the original statement? Initially, a clear table indicated the cars affected by the CAN injection problem, with a projected resolution by the end of April.
2. Why is there excessive delay in addressing this issue for the affected cars? The solution was supposed to be already applied to revised car models after October 2022.
3. Is this issue being overseen by senior members of the Toyota group beyond the UK? Is it being given the necessary urgent priority? What is the current deadline? This is a deeply concerning issue impacting many past, current, and future Toyota owners, as well as dealers. If Toyota genuinely cares about its customers, there should be continuous updates.
Hi Bruno, thanks for your comment.
The risk level of each model differs depending on the exact production date, so we require the registration number to confirm this. Your local Toyota Centre can also provide assistance if you’d prefer.
We have had ongoing investigations into the rise of vehicle theft and are liasing with different authorities and others within the industry. We hope to have further updates soon.
Thanks,
Toyota UK
Are rav4s manufactured after a certain date better protected or new one’s improved?
Hi Robert, thanks for getting in touch.
We would need your registration number to confirm the risk level of a vehicle.
Thanks,
Toyota UK
I have an unblemished driving record, have not made a claim for theft from a car in over 40 years, and keep my 65-registered Toyota Auris Hybrid behind locked gates at night. Despite all this, I recently received an email from my insurance company (LV) that they will no longer insure me.due to the number of thefts and the cost of repairs for this type of vehicle.. I immediately forwarded the email to my local Toyota dealership (Hadfield Road in Cardiff) expressing my concern that a major and reputable insurance company deems one of their models to be uninsurable, and asking for comments, but a week later I have not even received an acknowledgment, let alone a response. I have owned Toyota Hybrid cars for almost 20 years, and am very disappointed by Toyota’s apparant indifference to the situation in which I now find myself.
Hi there, thanks for getting in touch.
We’re sorry to hear this. The Auris is not deemed as at risk of CANbus theft. The team at Toyota Insurance Services will be happy to provide an insurance quote and can be contacted on 0333 103 9950 or https://portal.toyotainsuranceservices.co.uk/
Thanks,
Toyota UK
Thanks for your reply, Toyota, but it misses the point. The issue is not whether an Auris is or is not at risk from CAN bus threat, but is that one of your popular models is deemed uninsurable by a major and reputable insurer. Is this of no interest or concern to you?
Hi there, thanks for your response.
We cannot comment on other insurance providers insurance policies, we would perhaps recommend sharing the information we have confirmed regarding the risk status of your vehicle with your current provider. Our team at Toyota Insurance Services will be happy to provide a quotation and their details can be found below.
Thanks,
Toyota UK
Well wouldn’t have faith in getting reasonable quote as i did a quote for Rav4 2020 and was double anybody else!!! Just shows you how much Toyota care about the customers when they can’t stop theft’s and have audacity to ask more for insurance!! SHAME ON YOU TOYOTA
Hello
I have recently purchased a 2023 (Dec 23 Reg) Toyota RAV4 GR. I wasn’t aware of this CANbus theft until reading this post, it want mentioned at the dealership. I’m just wondering if my car is at risk and what additional measures are available to protect my vehicle. Reg NT64***
Hi Neil, thanks for your comment.
We will need your full registration number to confirm this please.
Thanks,
Toyota UK
Hi Thanks for your reply. That is my vehicle registration.
Sorry about that, Neil.
Your RAV4 is deemed as at risk of CANbus theft. We currently offer a Vehicle Protection Plate for this vehicle, which your local Toyota Centre can fit for you. We are also working on further security enhancements, which we hope to be able to confirm soon.
Thanks,
Toyota UK
Thank you for your reply and I’m disappointed that this wasn’t mentioned at the time of purchase or indeed an offer for the vehicle protection plates to be fitted prior to me collecting the car. Can I ask that since this is a security failure that is recognised by Toyota who as you say are working on a fix, is the supply and fitting of the VPP covered by Toyota or yet again the poor motorist has to cover the cost of this defect? I have also read about fitting a Ghost II system to the car, which in effect disables the car, doesn’t stop the damage, but there is a comment that fitting such a device will invalidate the warranty, is this correct?
Hey Neil,
We can only apologise for any disappointment caused by this.
The VPP is available to be fitted free of charge by your nearest Toyota Centre.
Ghost immobilisers are third party products and would not invalidate warranty but if a fault occurred due to one being fitted this may have a affect on the part that is affected by this.
We hope this helps.
Thank you.
Thank you for your reply. I have been in contact with the dealership that I purchased my Rav 4 GR from . They tell me my car is NOT at risk! I quote “The RAV4 range that could potentially be stolen were produced between April 2019 to October 2022, the good news is your vehicle was produced in December 2022.
This means you vehicle was modified on the production line and is not subject to this type of theft.”
Therefore who is correct please? You say it is at risk can you please clarify as I assume you have access to the same data as the dealership in terms of when my vehicle was manufactured?
Hi Neil, thanks for your comment.
We apologise for the mistake, the advice given by your local dealership is correct. Your RAV4 falls outside of the risk period for this particular model, our mistake.
Thanks,
Toyota UK
Is a 2018 rav4 excel Registration X10JMY at risk of can bus attack
Hey Jim
Your RAV4 is not deemed at risk of CAN bus theft.
We hope this helps.
Thank you.
Hi Toyota,
Having you considered offering your customers a monetary contribution so they can pay to install something like Ghost II on their cars?
It would probably be a welcomed gesture of good will given the wait and thousands spent buying the car.
Kind regards
Hi Neo, thanks for your comment.
We are currently working on further security enhancements and hope to have an update soon.
Thanks,
Toyota UK
I appreciate you publishing the question, as well as the response, but this status has been much the same for a while now. In the meantime cars are being stolen, distress and inconvenience caused, and expense incurred. No doubt people are also spending more money on security devices which they’ll never recoup. I’m somewhat disappointed. Whilst I love the car and Toyota is better than some manufacturers, action isn’t quick enough and nothing to bridge the gap. That’s poor.
My Toyota Aygo fire X 2023 was broken into last night.
I saw a notification that the driver side door and rear hatch were open.
Looking on the cameras, the thief cycled up to the door literally held the button and bypassed all security and stole a bunch of things.
I have the whole thing on camera. I feel very unsettled and un secure with the car. What will Toyota do to fix this issue and why did it happen?
Hello Arya,
We are terribly sorry to hear about this.
However, due to the platform of the vehicle, the Aygo X is not affected by CAN bus theft, the method discussed in this article.
As we’re sure you can understand, it is difficult for us to comment on how your Aygo X was broken into virtually.
We have a separate article on car security which we’d recommend reading here – https://mag.toyota.co.uk/car-security-advice-and-tips/
Thank you.