The motor manufacturer Hyundai faces legal action over allegations it failed to warn its customers that one of its most popular models of electric cars could be stolen “effortlessly in seconds”. Elliott Ingram, an expert in digital security, was stunned when a CCTV camera installed at his home recorded a hooded thief stealing his Hyundai Ioniq 5 car in less than 20 seconds.
The thief is believed to have used a device, available online, to mimic the car’s electronic key. It is the latest in a spate of thefts involving the vehicle, and many owners now resort to a steering lock. Ingram’s car was later recovered by police, but he is terminating the lease and seeking compensation from the motor company. He says the South Korean car giant should have alerted customers to the security vulnerabilities.
“This security system has been completely blown open, so anyone can attack it,” he said. “It’s no longer fit for purpose.”
Hyundai promotes the convenience of its digital and smart keys, which allow motorists to lock or unlock the doors and start the engine while carrying just a key fob or digital key. The new technology includes several security measures but can be defeated by criminal gangs.
Ingram discovered a key emulator device being marketed online for €15,000 (£12,500), which claimed to be able to gain entry to the Hyundai Ioniq 5 and a number of other models. The physical appearance of the device is based on the Nintendo Game Boy games console, and it can be operated in either English or Russian. “The device records the signal from the car and within 10 seconds to two minutes completely [duplicates] the native one,” says the website promoting the device. “The key can be stored in the device’s memory. Open, close, start and go at any time.”
The Observer revealed last year that the car industry ignored warnings more than a decade ago that keyless technology risked a surge in vehicle thefts. Experts warned keyless systems could be “successfully undermined” and vehicles stolen without forced entry.
Ingram, 38, who lives in north London, says Hyundai had warned him of other modifications the vehicle required, but failed to alert him and other motorists that its security systems were compromised. He intends to file a claim against the company over the theft unless he receives compensation, citing a breach of the Consumer Rights Act. In a letter to Hyundai, he wrote: “The thief was able to enter the vehicle and steal it effortlessly in seconds. Had I been informed of this specific security risk, I could have taken additional deterrent measures, such as installing a secondary immobiliser or using a steering lock.” He said the motoring manufacturer should “urgently inform” its customers of the vulnerability and ways to avoid theft until the security risk is remedied. Hyundai said in its response to Ingram that there was an industry-wide issue of organised criminal groups deploying electronic devices to illegally override smart key locking systems. It said it was working with police to understand more about the devices and track vehicles as possible.
Hyundai said its vehicles met all the required security standards for the UK market, and it was developing updates to reduce the risk of keyless thefts. It said vehicles sold from February 2024 have the latest updates to “mitigate” risk and it was working on offering retrospective action to customers with cars placed in the UK market before February 2024.
Car thefts in England and Wales have risen from 70,053 in the year to March 2014 to 129,127 in the year to March 2024, a rise of 84%. According to the 2022 to 2023 Crime Survey for England and Wales, remote devices were used by offenders in 40% of vehicle thefts.
Under the crime and policing bill currently going through parliament, a ban on the electronic devices used to steal vehicles with keyless ignition will be introduced. Under the new laws, anyone who is found in possession of such a device, or to have manufactured, imported or distributed them, could receive five years’ imprisonment and an unlimited fine.
Ministers hope the new laws will disrupt the distribution of car theft devices to organised crime groups. The RAC says car thefts are driving higher insurance costs and the new laws “cannot come soon enough”.
Ken Munro, a founding partner of Pen Test Partners, a cyber security testing house, said car manufacturers were improving car security, but there was a lucrative criminal industry in designing products that exploit “cracks” in the technology. “The average car thief doesn’t need to be a hacker,” he said. “They just need to buy a product that allows them to hack and steal a car.”
Hyundai said it was working hard to combat the thieves, but was not planning a recall of any vehicles. “The software and hardware updates that we have and are implementing will significantly reduce the risk of this particular form of vehicle theft occurring in the UK,” said a spokesperson. “However, this is a race against very determined, well-funded individuals who stop at nothing to steal vehicles for multiple purposes.”
