We take the issue of Toyota and Lexus vehicle theft very seriously. We are continuously developing technical solutions to make our vehicles more secure, to help reduce the risk of theft.
An enhanced security hardware system was introduced in October 2021 (Lexus) and October 2022 (Toyota) on the latest models targeted by criminals. Since which, we have seen a significant drop in thefts of those models.
For older models, we endeavour to create solutions that can offer enhanced protection to our customers. Following significant investments by Toyota GB, in line with that of other vehicle manufacturers, newly developed official Toyota and Lexus security hardware components will very soon be available to fit to those targeted models registered before October 2021.
Following communication from Toyota and Lexus in the coming weeks, owners should contact their local dealer to arrange fitment. Customers can already speak to their local dealer about the fitment of a protective plate to block access to the vehicle’s electronics. This is a nationwide customer care offering available on Toyota RAV4 Hybrid, Lexus RX and Lexus NX.
As a vehicle manufacturer, we can never completely eliminate the risk of vehicle theft. This is an industry-wide issue, concerning all vehicle manufacturers and affecting the most popular models first.
In order to further reduce the theft risk, we regularly collaborate and share information with insurance associations, police and law enforcement authorities, theft prevention experts and other key stakeholders around the world. This enables us to understand new threats and techniques used by thieves and develop more secured systems.
Alongside our efforts, we urge those authorities to focus on reducing the number of thefts. We would also like to see action taken that leads to the end to the online sale of devices used by criminals to steal cars without using the car keys, as these devices serve no purpose other than a criminal one.
How do thieves manage to steal cars in this manner?
The thieves disconnect part of the headlamp and use a malicious device to send signals to the control CAN bus (the communication ‘backbone’ within a car) that allow the doors to open and the car to start without the key or remote control.
Thieves need to:
- Purchase a relatively expensive rogue device (third-party ‘emergency start‘ device which costs around £2500 – £4000 each)
- Gain physical access to the vehicle’s CAN bus communication wires for an uninterrupted period.
The third-party ‘emergency start‘ device has the capability to initiate an exploit in the following manner:
- Once connected to the vehicle’s CAN bus communication wires, the third-party ‘emergency start‘ device can send a prioritised series of CAN signals to bypass the vehicle’s security and immobiliser systems, which could allow a thief to unlock the doors and turn the vehicle’s ignition ON.
- The third-party ‘emergency start’ device is then disconnected.
- At this point a thief can enter the vehicle and start the car without the key.
What is Toyota doing to prevent these types of attacks?
Toyota and Lexus take the issue of car theft very seriously. We are continuously developing technical solutions to make our vehicles more secure to help reduce the risk of theft.
In fact, in the UK market, an enhanced security hardware was introduced in October 2021 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
We cannot divulge the precise nature of the imminent security enhancement; should we do so we risk offering information into the public domain that could be of interest to criminal parties.
The intention is to make the security enhancement available to vehicles affected by CAN bus theft.
What models are known to be targeted by this issue and are newer models affected?
The models primarily targeted are fourth-generation Lexus RX and the Toyota RAV4.
For older models we endeavour to create solutions that can offer enhanced protection to our customers.
Since October 2022, Toyota models are subject to a platform change that negates CAN Bus theft. This excludes Hilux, which is not subject to CAN bus attacks.
When did Toyota first become aware of the vulnerability in the security systems?
It is not so much vulnerability of the security systems but more so the growing rise in criminal gangs targeting vehicles for ‘cannibalisation’ and/or complete theft.
Instances appear to have been rising significantly from 2019-2020.
There are many factors involved and at a global level. This includes parts of the world experiencing parts shortage which results in targeted thefts to supply vehicles and/or parts sent to countries experiencing trade restrictions.
Which models can be fitted with the enhanced security feature?
It can be fitted to Land Cruiser 150, RAV4 and first-generation Toyota C-HR.
When is the enhanced security upgrade going to be available and will it be free of charge?
Exact timings are still to be confirmed. We anticipate being able to advise the Toyota Centre network with full details soon. The security enhancement needs to be carried out at a Toyota Centre. Costs are under review; customers may incur a nominal charge.
Are any new models targeted by thieves?
While no car can be considered 100% immune to criminal intent, more recent models are equipped with enhanced security systems aimed at deterring CAN bus type thefts.
Given that the rise in this type or car theft has been known for several years in other countries and is growing in the UK why wasn’t I told about this?
Toyota takes the issue of car crime very seriously. To protect customers’ vehicles our approach is not to disclose our vehicle theft analysis data. The sharing of information could enable thieves to find ways to circumvent anti–theft technologies or make some models particularly attractive to some thieves and unnecessarily vulnerable to attack.
Is a Vehicle Protection Plate (VPP) available for any Toyota models?
Yes, for RAV4, excluding the Plug-In Hybrid model (which is not susceptible to CAN bus attack). The fitment is chargeable.
What is the countermeasure and what’s the plan moving forwards?
We are continuously developing technical solutions to make our vehicles more secure and reduce the risk of theft. An enhanced security hardware was introduced in October 2022 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
Why is there no recall for vehicles susceptible to the CAN bus attack?
Recall announcements in the UK are guided by very specific guidelines as drawn up by the Driver and Vehicle Standards Agency (DVSA). To qualify as a recall, the issue must relate to a safety or thermal type issue where there is potential for injury as a result of vehicle manufacture or component failure. Only in these such circumstances can a recall be announced. In recall circumstances, the DVSA will provide manufacturers access to ownership records for purpose of communication. Instances of theft do not trigger a recall.
Will Toyota pay for damage caused by an attempted theft?
No. This will need to be addressed by the customer and the vehicle insurers. While we understand theft or attempted theft can be highly upsetting and, in some cases, a costly experience, in such instances customers are first and foremost victims of crime. Toyota does not cover costs associated with criminal activity either under the terms of the warranty or as goodwill.
What is the position with insuring affected models?
As a manufacturer, we stay close to Toyota Insurance colleagues and indeed all motor insurers. We are aware that in many cases, insurance premiums might have increased as a direct result of vehicle crime. We need to refer you to your insurer for further comment.
Our (2017/18) Toyota Prius was stolen from in front of our house last night, no keys were in the car and it was locked but they managed it anyway. We’re thinking twice about getting another one as even though it was a good drive and efficient, it was under threat of theft/CAT removal the entire time we had it, judging by the number of Prius thefts around us. Do newer models no longer carry this threat and if so from what date range? Would you advise fitting a steering lock as well as a tracking device on a future car or do some of these already have tracking devices built in? I also own a 2009 Yaris with my sister. Like the Prius that got stolen it has a cat lock. Should I do something to enhance its security further?
Hi Gita, thanks for getting in touch.
We are sorry to hear your Prius has been stolen. We would always recommend secondary precautions such as steering/wheel/pedal/gear locks to act as a visual deterrent and many people also look into trackers and immobilisers.
We do not publish the full details of succeptibility, but if there is a particular model that you are interested in the selling dealership will be more than happy to confirm the risk level.
Thanks,
Toyota UK
In many responses, the standard message from the UK team has been to acknowledge the problem, state that thieves have outsmarted Toyota engineers, and that Toyota engineers are working on addressing security issues. Can you specify when this has occurred and how long it typically takes to resolve such issues?
It seems misleading to suggest that Toyota is always on top of new security breaches when, in reality, car security isn’t updated until a new model is released, which can take years. As a customer, I expect continuous updates to address security issues throughout the vehicle’s lifetime, free of charge. This is common practice in many industries, and cars should not be an exception.
How does the Toyota group plan to maintain the trust of affected customers?
Toyota has stated that it will not provide monetary support to those affected, as it does not support theft activities. However, this is about compensating loyal Toyota customers for economic losses due to a technical security failure beyond their control. Even if a customer is aware of the issue from the start, it is not possible to apply a third-party immobilizer due to its impact on the hybrid system. By not addressing this problem promptly, Toyota indirectly supports criminal activities. Ultimately, is the security issue a customer problem or a Toyota problem?
3rd party immobilisers work perfectly fine with the Toyota hybrid system if the installer knows what there doing, unfortunately most don’t.
we have just bought an TOYOTA RAV4 DYNAMIC PHEV AUTO from the Toyota main dealers this month. Would the dealership add the protection plate or do you have to ask for it?
I’m taking this model is affected?
Hi there,
The RAV4 Plug-in is not affected by this type of theft, so you will not need a protection plate.
Thank you.
Hi RG, thanks for getting in touch.
If your RAV4 is affected by CANbus theft, a Vehicle Protection Plate can be fitted. We’d recommend checking this with the Toyota Centre that has it up for sale, it is an optional precaution so just let them know you’d like to have it.
Thanks,
Toyota UK
Hi Toyota Team,
I have just ordered a RAV4 HEV and i wasnt aware of this theft risk.
I understand that since the car is going to be manufacture in 2024, and even though it is HEV, I am safe from CANBUS attack.
Please, could you confirm it for me? thank you so much
Hello Michael,
Thanks for your question.
Your RAV4 will benefit from the software upgrade to mitigate against this type of theft.
We hope this helps.
Thank you.
What software upgrade is this? And how can I get it?
Hi Erick, thanks for getting in touch.
Your local Toyota Centre is best placed to provide further information on this.
Thanks,
Toyota UK
Is my CHR affected? It’s a 2021 model. Reg on request.
Hi Sally, thanks for getting in touch.
Your Toyota C-HR will be at risk of CANbus theft. We’d recommend getting in touch with your local Toyota Centre so they can let you know when further security updates are available.
Thanks,
Toyota UK
29/8/24
My partners 2023 Hilux has just been stolen !!! For a £40+k vehicle what is being done ?! This is a very distressing experience for us all.
Hi there, thanks for your comment.
We’re so sorry to hear that you have been a victim of theft, we hope your Hilux can be recovered swiftly. No doubt you have already done so, but please inform the authorities and your insurance provider.
Thanks,
Toyota UK
Hi Toyota team, my plug in Prius was stolen using can bus, I watched it with my security cameras so know what they did and the bits of plastic that where left on the floor to gain access inside car. I have got my car back, gave Police address where it was left using tracker. So plug in Prius can be stolen. Could you please tell me please what damage could be done to my wiring ect. My insurance have not got a clue what to do.
Could you please advise me.
David
Hi David, thanks for getting in touch.
We’re so sorry to hear that but pleased to know your Prius has been recovered. Your local Toyota Centre would be best placed to perform a check over of everything to make sure it is all ok.
Thanks,
Toyota UK
Hi there,
We will need your full registration number to check this.
Thanks,
Toyota UK
Good morning Daniel,
Yes, unfortunately your Toyota RAV4 Hybrid is susceptible to CAN bus theft so we’d recommend getting in touch with your local Toyota Centre to find out more about additional security measures.
Thank you.
Is my car at risk BR21***?
Good morning Richard,
Yes, unfortunately your Toyota C-HR is susceptible to CAN bus theft so we’d recommend getting in touch with your local Toyota Centre to find out more about additional security measures.
Thank you.
Hi, I have done this, but the approved toyota dealer Ron Brooks Mansfield has said there are no additional security measures that can be offered at present for CH-R. Only for RAV4. I have now been forced to spend another £60 on a steering lock. Please update the dealers with the correct information so they can advise customers on security upgrade timescales ASAP.
Having bought a used Toyota with a 2020 plate at the end of last year, which was nearly stolen last night, I would like disclosure as to when you became aware of this security vulnerability (stating it isn’t one is offensive, as it is the equivalent of leaving a back door open). If you were aware of it before I purchased the approved used vehicle, why wasn’t the CANBUS protection plate installed as part of the process at the dealership; if it was after my purchase, why wasn’t I informed by the Toyota Dealership that there was a significant vulnerability that needed resolving. Either way there is a concern in your processes that need resolving as opposed to sweeping these things under a carpet and being left to consumers to pay for your failures via insurance companies.
The lack of disclosure is leaving me in a position where I do not trust the Toyota brand
Good morning Darren,
We’re sorry to read you feel this way.
Congratulations and thanks for choosing Toyota. Please may we take your registration so we can check if your car is susceptible to CAN bus theft.
Thank you.
My Reg is EX70 ***. I found the car in the morning with the the passenger wing pried off, the headlamp unit unplugged, and the car unlocked. Had a neighbour not disturbed them, I am fairly sure the car would have gone
Thanks for confirming your registration, Darren.
We’re sorry to hear of your experience and the distress and inconvenience this has caused.
Yes, unfortunately your RAV4 Hybrid is susceptible to CAN bus theft so we would recommend getting in touch with your local Toyota Centre to find out more about additional security measures now available.
Unfortunately, criminals are continuing to find ways around new security technology. Please be assured that we are working with relevant parties including the police to put a stop to this horrible crime. Here are our top recommendations for improving car security: https://mag.toyota.co.uk/car-security-advice-and-tips/
Thank you.
Can I ask why the dealership charge £70 to fix a security vulnerability on an approved used vehicle? Surely this should be done as part of warranty?
Hi Darren, thanks for getting in touch.
This cost was for the labour involved in the fitment, there is no cost nor profit to the part itself.
Thanks,
Toyota UK