Volvo-Eicher fleet platform exposed 748,000 customers and 676,000 vehicles through unauthenticated APIs

Volvo-Eicher Fleet Platform Exposed 748,000 Customers Through Unauthenticated APIs

Internal APIs in My Eicher, a fleet management platform operated by the Volvo-Eicher joint venture VE Commercial Vehicles, were accessible without any authentication, exposing records for 748,000 customers and 676,000 commercial vehicles in India. The exposed data included Aadhaar cards and driving licenses, live OTP records that enabled full account takeover, and real-time GPS tracking for any vehicle in the system 1.

VE Commercial Vehicles is a joint venture between the Volvo Group and Eicher Motors 1. My Eicher lets commercial fleet operators in India track trucks and buses in real time, set geofences, and view live vehicle diagnostics from a phone or browser 1. It is the kind of platform that holds exactly the data an attacker wants: location, identity documents, and authentication tokens, all behind one perimeter.

The discovery was a truncated URL

The researcher found the flaw by removing the last segment of a legitimate API URL. A public endpoint used to validate mobile numbers lived at a predictable path on the My Eicher website. Truncating that path in a browser returned a full list of internal user-management APIs, none of which required authentication 1.

One endpoint returned the entire customer database: 748,000 customer records, 174,000 user accounts, and 186,000 person records 1. The vehicles endpoint returned data for 676,000 commercial vehicles, including real-time location and live gauge cluster readings 1. A documents endpoint exposed 76,000 uploaded files, among them Aadhaar cards and driving licenses 1.

OTP records enabled account takeover

The most damaging finding was an API that returned 2.5 million OTP records dating back to 2021 1. One-time passwords are My Eicher's primary login mechanism. An attacker who could read the OTP sent to any user could intercept the login flow and seize that account, gaining control over the user's entire fleet.

The researcher demonstrated the attack against an account linked to a large engineering company. This method had a limitation: sending an OTP to a victim's phone tipped them off. But a second unauthenticated API allowed password changes on any account, which could enable a silent takeover 1.

Account takeover on a fleet platform goes beyond reading data. It means controlling who can see where vehicles are, who can set geofences, and who can access live diagnostics. On a system tracking 676,000 commercial vehicles across India, that is a physical-security and supply-chain concern, not just a privacy breach.

17 days to fix, no acknowledgment

The researcher reported the vulnerabilities to VECV on November 3, 2025 1. VECV did not respond. The researcher followed up on November 10. No response. They followed up again on November 17, copying additional contacts. On November 20, 2025, the internal APIs were no longer accessible. The primary flaw was fixed 1.

Seventeen days from report to fix, with zero acknowledgment from VECV. After November 2025, the researcher identified additional concerns and tried to relay them through customer support channels, but could not reach anyone willing to investigate. They eventually stopped trying 1. Full technical details were published today, July 27, 2026.

What connected fleet platforms still get wrong

The My Eicher breach fits a documented pattern. OWASP's API Security Top 10 identifies broken authentication as a top vulnerability class, noting that internal APIs accessible without authentication let attackers gain complete control of user accounts 2. OWASP guidance specifically warns that password-reset and account-recovery endpoints should receive the same protections as login endpoints 2. My Eicher's password-change API required no authentication at all.

Connected fleet platforms aggregate location data, government identity documents, and vehicle controls in systems that often grew from basic GPS telematics into full mobile-app ecosystems without a corresponding security overhaul. The result is infrastructure that handles industrial-scale logistics but runs on access controls that a single URL truncation defeated.

The scale gap is visible in the numbers themselves. As of November 2024, VECV publicly stated that 275,000 vehicles and 115,000 customers were registered on My Eicher 1. The unauthenticated APIs returned 676,000 vehicles and 748,000 customers. The researcher could not explain why the figures diverge so significantly 1.

For the 676,000 vehicle owners whose real-time location was readable by anyone who truncated a URL, the lesson is that any platform holding Aadhaar numbers, driving licenses, live GPS coordinates, and OTP records behind a single perimeter is only as secure as its weakest endpoint. My Eicher's weakest endpoint required no credentials, no exploit, and no expertise to reach.