Canbus theft scandal

[fezman]

The canbus issue won't affect new car sales. I think i read all new models have an encrypted canbus. Ironically, that may help them as RX4 and other affected owners upgrade because of it. However, dealers must have lost a ton of money on resale values, annoyed customers etc. plus RX4's sat on forecourts for longer than usual. 

[Tickedon]

19 minutes ago, fezman said:

The canbus issue won't affect new car sales. I think i read all new models have an encrypted canbus. Ironically, that may help them as RX4 and other affected owners upgrade because of it. However, dealers must have lost a ton of money on resale values, annoyed customers etc. plus RX4's sat on forecourts for longer than usual. 

We don’t even know if the new UX 300h is vulnerable. Both the 250h and 300e were - so it’s plausible it’s still vulnerable. The same for the ES - unclear if there have been any changes. 

The original article provided dates, now it just lists lots of models and only says the new NX and RX, plus LBX, have the new platform with security changes… 

[GSLV6]

I tried negotiating down the forecourt price of a 2022 RX4 which was on at top dollar price, but the dealership wouldn't budge an inch and was clueless about affects on value recognised by non franchised dealerships on value of used RX4's.  Here's an example.  Both 2022 models, one a Takumi (non franchised) and one an F-sport (Takumi pack) from a franchised dealer.  The Takumi was immaculate, only 10K miles and was on for £36K with mine close on 17K part ex as an offer.  The F-sport had 14K miles and the franchised dealer wanted 6K more and offered less for mine.  I was astonished at the reluctance or ignorance about insurance premium hikes and canbus vulnerability hitting used values by the Lexus dealership.  I told them that.  They, I believe, will discuss it with their tech team and come back to me with a better offer.  It's a buyers market and no RX4 is currently worth top book value as whole life costs are so badly hit by the vulnerabilities.  Anyone wanting to buy one and run it for at least 5 years is advised to bargain hard or look elsewhere as great offers exist...just not with Lexus dealerships it seems.

[Alan305]

Sadly, after owning six Lexus models I decided to leave the mark. I got a standard response to my email to customer relations so decided it was over.

Good luck to everyone trying to get through to them.

Anyone contacted Watchdog journalists to point out Lexus have reduced the response they made during the program?

[Pinkfish]

On 5/13/2024 at 9:28 PM, Alan305 said:

Sadly, after owning six Lexus models I decided to leave the mark. I got a standard response to my email to customer relations so decided it was over.

Good luck to everyone trying to get through to them.

Anyone contacted Watchdog journalists to point out Lexus have reduced the response they made during the program?

I have experienced the same. Lexus are a bust flush. Their brand is all about customer loyalty -  but loyalty is a two way process.  I have registered with LD, and if Lexus won't own up and fix the issues, then it is time for court action.  

[Pinkfish]

On 5/10/2024 at 5:47 PM, fezman said:

The canbus issue won't affect new car sales. I think i read all new models have an encrypted canbus. Ironically, that may help them as RX4 and other affected owners upgrade because of it. However, dealers must have lost a ton of money on resale values, annoyed customers etc. plus RX4's sat on forecourts for longer than usual. 

A large part of the Lexus market is repeat sales - because of brand loyalty.  Also Lexus cars have always retained their value better than other cars.  This security debacle and, worse, how poorly it has been handled by Lexus, has trashed the brand, and this will impact future sales. 

[GSLV6]

Well, there may be light at the end of the (long) tunnel...I spoke to Lexus last week and dealerships have been informed there's a software/hardware fix due to be rolled out to all RX4 owners this summer sometime.  It's likely to involve a piggyback retrofit which detects when the CanBus system's been interrupted and a hack attempted, such as disconnecting the headlamp CanBus connector and attempting a hack.  This would initiate a security lockdown unless the key is used, thereby preventing CanBus type thefts.  Time will tell but I get the feeling dealerships know more than they're letting on.  My local one's sales people claimed to know nothing about the CanBus thefts, to which my response was "I find that very hard to believe!" only to be met with a blank stare.  The techs knew all about it.  Trust has been broken but might be restored if the fix details have a shred of truth and are rolled out.  Too much guesswork presently, so "wait and see" is the byword.

Meantime, offers on trade ins are derisory and used RX4 prices are being held high except at non franchised dealerships.  I would have gone to a non franchised dealership had one got the variant in stock that I wanted. As it is, the only variant I want is found at a Lexus dealership who offered me £2,5K less for mine in part-ex than an indy did (I turned down their Takumi as it wasn't what I wanted).  I get the feeling that Lexus are not living in the real world presently.

[Spock66]

The fix will also need to be free of charge, otherwise criminals will still be ripping off bumpers etc in the hope they find a car that has not been upgraded.

8 minutes ago, GSLV6 said:

Time will tell but I get the feeling dealerships know more than they're letting on.

Presumably they are under NDA from Lexus, but crazy Lexus has not given an update if this is the case.

[GSLV6]

It would, as I understand it, be treated as a recall (so FOC) with a nominal sum for fitting (a bit like the plates) but as a recall is technically for safety reasons and this isn't safety related, there's no statutory pressure on them to speed things up.  I agree about the NDA.  I guess they're late with their planned roll out which seems to indicate either procurement or design is late.  The dealer announcement was meant to be from April 2024 and we're a month past that now.

[Pinkfish]

On 5/19/2024 at 10:58 AM, GSLV6 said:

Well, there may be light at the end of the (long) tunnel...I spoke to Lexus last week and dealerships have been informed there's a software/hardware fix due to be rolled out to all RX4 owners this summer sometime.  It's likely to involve a piggyback retrofit which detects when the CanBus system's been interrupted and a hack attempted, such as disconnecting the headlamp CanBus connector and attempting a hack.  This would initiate a security lockdown unless the key is used, thereby preventing CanBus type thefts.  Time will tell but I get the feeling dealerships know more than they're letting on.  My local one's sales people claimed to know nothing about the CanBus thefts, to which my response was "I find that very hard to believe!" only to be met with a blank stare.  The techs knew all about it.  Trust has been broken but might be restored if the fix details have a shred of truth and are rolled out.  Too much guesswork presently, so "wait and see" is the byword.

Meantime, offers on trade ins are derisory and used RX4 prices are being held high except at non franchised dealerships.  I would have gone to a non franchised dealership had one got the variant in stock that I wanted. As it is, the only variant I want is found at a Lexus dealership who offered me £2,5K less for mine in part-ex than an indy did (I turned down their Takumi as it wasn't what I wanted).  I get the feeling that Lexus are not living in the real world presently.

Yes the dealerships are blanking their customers. Short sighted and then some.  I have taken a huge hit over the last two years - damage from an attempted theft and eyewaterinw insurance costs.  The failure to warn us about the vulnerability and speed of action from Lexus will cost Lexus dear, as will the legal action to recover our loses.

[GSLV6]

Let's wait and see.  If nothing is rolled out this year, then my bet is nothing will be rolled out at all.  Lexus UK have been very slow to react and inform customers of something they've known about world wide.  What makes the mind boggle as that some senior design manager in Japan actually signed off on something they would have known was hackable because security systems, including the immobiliser, were not separated from the vehicle operating system wiring.  It wouldn't have cost any more in production on a vehicle to do this, well, very little anyway.

 

They're not the only ones as Land-Rover, Porsche and a fair few others committed the same grave error.  It all points, along with the flood of new Lexus models, to a cheapening of what was once and exclusive brand, supplying impeccably designed and made vehicles.  I remember an ex Jag employee saying that they bought a Lexus and stripped it as they couldn't understand why they (Jaguar) had so many electrical faults when Lexus didn't.  They were astonished to find that all systems wiring that had to be routed through the monocoque structure had bespoke channels pressed into the chassis especially for the wiring to keep it safe from pinching and damage.  That attention to detail at the design stage seems to be lost to a different profit model where electronics are concerned.

 

My RX4 will likely be the last one I ever buy as a result.  I won't fall for the false promise again  of quality when there's clearly such major oversights unless I see they address the vulnerability within the Lexus/Toyota Group.  Makes you think of what else they've cut corners on...leaking roofs for example (via roof rails) and premature wear on some suspension parts.

[shadows]

It's been months already and honestly this is getting ridiculous.

For me, it's time to make a statement ourselves, otherwise, Lexus might never do anything about it.

Therefore I recommend we all register interest:

https://www.leighday.co.uk/forms/toyota-and-lexus-can-invader-registration-of-interest/