A totaled Tesla was sold for parts in the U.S. but came back online in Ukraine — here’s what happened

A Tesla Model X totaled in the U.S. late last year suddenly came back online and started sending notifications to the phone of its former owner, CNBC Executive Editor Jay Yarow, months later.

The car or its computer was suddenly online in a southern region of war-torn Ukraine, he found by opening up his Tesla app and using a geolocation feature. The new owners in Ukraine were tapping into his still-connected Spotify app to listen to Drake radio playlists, he also discovered.

When Yarow posted about this to the social network X, formerly known as Twitter, his post went viral, and followers wanted to know why this was happening and whether it was a security risk.

According to the CTO of automotive security firm Canis Labs, Ken Tindell, there can indeed be a security risk with totaled cars that are restored.

He explained in an email to CNBC, "The credentials to internet services are clearly left in the vehicle electronics and then can be used by whoever gets hold of the electronics." He added, "In general it's possible to get data out of working electronics — it's merely a question of how much effort that takes." 

This is far from a Tesla-specific issue, he said. Cars, like laptops, smartphones, and even refrigerators and TVs, are now internet-connected devices that can store personal data.

"I think it needs to be more widely understood by dealers and owners that there is this issue of private data within the vehicle," Tindell said.

How did the vehicle end up in Ukraine?

CNBC found that after the car was totaled, online auction site Copart listed it for sale, according to website listings. The company, which currently has more than 1,600 Tesla vehicles listed for sale, is connected to salvage yards across the U.S., including one in New Jersey where the car ended up.

Copart specializes in damaged or totaled vehicles that have what's called a "salvage title," issued when an insurance company declares it a total loss, warning future buyers that there was a significant problem. Copart sells more than 2 million vehicles a year, with operations in 11 countries, according to the company's website.

Such vehicles cannot legally drive on U.S. roadways, but some countries aren't as stringent.

"Cars go to the repair shop or junk yard then find their way to a second market and then are suddenly being shipped overseas," said Mike Dunne, a former General Motors international executive who now serves as CEO of auto consulting firm ZoZoGo.

The practice has been going on for decades and accelerated with the rise of digital auctions, according to Steven Lang, an auctioneer and founder of used car marketplace 48 Hours And A Used Car.

"Starting in the Y2K era, the digital auction site took over. So now you can have someone in Ukraine bidding on it. And then someone else from Norway bidding on it … and you haven't even touched an American border or an American bidder," said Lang, who has been in the vehicle auction business for more than 24 years.

"Virtually all of the vehicles that are totaled will end up at a salvage auction," he said.

One online auction website that specializes in such sales estimated the winning bid for the vehicle would be between $27,400 and $29,400. A final sale price was not immediately known. Neither the salvage yard nor Copart immediately responded for comment about the vehicle and who bought it.

Tesla support staff told Yarow he should disconnect his car from his account, offering the following instructions via email:

Tesla didn't tell him how he was supposed to obtain the new owner information as he hadn't sold the car.

According to Tindell, disconnecting one's account from a totaled vehicle can help stop others from using apps that had been connected, such as Spotify in Yarow's case. However, data could still be extracted from the totaled vehicle's electronics.

"What would the trip history and phone book of a celebrity be worth to a blackmailer or a kidnapper?" Tindell asked.

He and other security experts compared the situation to having an Apple laptop stolen. In some cases, Apple can wipe the laptop or device clean remotely when it comes online. But "a malign repair shop can take out the hard drive and copy all the data off it before scrapping a broken laptop."

This is why Apple routinely encrypts its hard drives, the CTO noted. "It's the only way to prevent the data being stolen by someone with physical access to an offline device."

Warren Ahner, an automotive cybersecurity veteran and founder of RightHook, said that ideally a company like Tesla would "Have a portal where a user can sign in with online credentials and say 'remove all my info, then disconnect my vehicle from the account,' and would be able issue a remote-wipe command to the car when it comes online, deleting it all including GPS, saved locations and the rest."

However, he said, owners can be their own "personal risk police," and avoid giving their vehicles or rental cars that they use lots of personal info.

"Always purge your data after you are done with the vehicle and try not to share more info with the car than you absolutely need to share," Ahner recommended. "If I pair my phone with the car I'm renting or owning I don't allow it to synch location and contacts. I only give it Bluetooth access to talk over the top of my music and so I can use whatever music streaming app I like."

An automotive white hat hacker who uses the handle Green the Only has been sounding the alarm about data on cars for years. "All the phone directory and calendar stuff might be valuable," he said.

Once a car or car computer has changed possession is back online, he says that the previous owners "can't do much." One problem is that an old owner can "accrue charges for Supercharging," and other items Tesla — or other vehicle makers — may sell on a subscription or pay-per-charge basis. They can always submit a request to Tesla to remove the car from their account, but that's it.

Green the Only agreed with Tindell and Ahner — Tesla "probably can add a 'remote wipe and then remove from my account' in addition to the 'remove from my account' option they have now. They probably should have added that long ago."