Editorial correction — October 7, 2026: This page now distinguishes the documented 2024 GitHub-token exposure from separate, unverified leak allegations. We removed unsupported data-volume and customer-count figures and an unsupported statement about the company’s response. Our review uses the public sources linked below; we have not examined stolen datasets or conducted an independent forensic investigation.
What the 2024 research report establishes
In its January 29, 2024 disclosure, RedHunt Labs reported finding an exposed employee GitHub token that allowed access to Mercedes-Benz’s internal GitHub Enterprise repositories. The researchers described source code and sensitive material including cloud access keys, database connection strings and other credentials.
The researcher’s timeline dates discovery to January 11, 2024, disclosure through TechCrunch to January 22, and token revocation and revalidation to January 24. It does not establish the 270GB figure previously published here, a confirmed theft of customer records, or exploitation of vehicles. Access exposure and confirmed malicious use are different findings.
Separate leak claims: what remains unverified here
An earlier version of this article described an alleged sale of legal and customer records under the alias “zestix,” dated it to 2026 and supplied specific volumes and customer counts. We do not have a primary-source disclosure supporting that combination of details. Those figures and the attribution of a company response have therefore been withdrawn from this article. This does not establish that no separate incident occurred.
A forum announcement, screenshot or sample advertised by a seller does not by itself establish the date of an intrusion, the number of affected people, the authenticity of records or whether the data came directly from the named company. A later vendor incident must be assessed separately from the 2024 repository exposure. Readers seeking personal impact information should rely on a notice addressed to them and verified company or regulator communications.
Practical response checklist for engineering teams
The following is a general response workflow, not a description of steps Mercedes-Benz took. A leaked repository token should trigger an investigation into its actual permissions and dependent credentials; simply deleting the visible token from a file is not a complete response.
- Contain access: Revoke the exposed token, identify the systems it could reach and record when access ended. Coordinate replacement credentials with service owners to avoid unnecessary outages.
- Check the exposure window: Preserve available audit records and inspect repository access, unusual downloads and related cloud activity. Record gaps in log retention rather than treating missing evidence as proof of safety.
- Review dependent secrets: Inventory credentials stored in accessible repositories. Prioritize rotation according to privilege, exposure and current use; check services after rotation.
- Reduce recurrence: Combine secret scanning with reviewed access permissions, short-lived credentials where supported and an assigned owner for each service identity. No scanner or vault guarantees immunity.
- Close with evidence: Document what was exposed, which actions were completed, what remains unknown and who owns follow-up. Keep confirmed findings separate from possible consequences.
Questions for readers and vehicle owners
Does source-code exposure prove a vehicle can be remotely controlled?
No. That conclusion would require evidence of a relevant vulnerability, reachable attack path and affected vehicle or software versions. The cited repository disclosure does not demonstrate that outcome.
How should I respond to a breach message?
Verify it using contact details obtained independently from the company’s official site. Do not download alleged leaked archives or provide identity documents to an unknown sender. If a verified notice identifies your information as affected, follow the notice’s specific instructions. Use available account security features and obtain vehicle software updates through official channels.
Related reading: our Software Supply-Chain Security Review and Data Breach Evidence and Response Guide.
