Researchers found a serious security vulnerability in Subaru’s Starlink system late last year. It enabled full access to private data including location, emergency contacts, call history, and more. Subaru patched the vulnerability within 24 hours but left broader privacy concerns unresolved.

Now-fixed web bugs allowed hackers to remotely unlock and start any of millions of Subarus. More disturbingly, they could also access at least a year of cars’ location histories—and Subaru employees still can.