The break-in did not need an exploit. Security researcher Eaton Works simply removed path segments from the API URLs that the My Eicher fleet app was already calling, hit the parent endpoints, and found them answering without any authentication at all. Behind those endpoints sat a user directory of 748,000 customers, a store of 2.5 million one-time passwords dating back to 2021, a password-change route that never checked who was asking, and 76,000 uploaded documents including Aadhaar cards and driving licences. The research was published on July 27, 2026, twenty months after the first report.

My Eicher is the fleet-management and GPS-tracking platform run by VE Commercial Vehicles, the Volvo Group and Eicher Motors joint venture that sells trucks and buses across India. With account takeover available two different ways, the practical reach was 676,000 vehicles: live location, live telemetry, and the identity documents of the people driving them.

RelatedKDDI Breach Exposes 14M Users, Passwords in Plaintext

How the bypass actually worked

Two independent paths to the same place, which is what makes this more than a leak. Read the OTP database and you can complete a legitimate login as any user, because the one-time password is the second factor and it was sitting in plaintext reach. Or skip the login entirely and call the unauthenticated password-modification route to set a new password on any account. Either way you arrive holding a real session, and everything downstream looks like an authorised fleet manager doing normal work.

That is the detail worth sitting with. An attacker exercising this does not trip anomaly detection, because there is no anomaly. The requests are well-formed, the session is genuine, and the tracking queries are the same ones the account owner would run.

Two unauthenticated paths to full account takeover on My Eicher Walking up to parent API endpoints exposed an unauthenticated user directory of 748,000 customers, an OTP store of 2.5 million codes, and a password-modification route. Either the OTP path or the password-reset path yields a valid session, giving access to 676,000 vehicles and 76,000 identity documents. UNAUTHENTICATED PATH · MY EICHER Parent API no auth required User directory 748,000 customers Read the OTP store 2.5M codes since 2021 Reset the password no authorisation check Valid session as any user 676,000 vehicles tracked live · 76,000 ID documents genztech.blog
Fig 1 Neither path required a credential. The OTP store made the second factor readable; the password route made it unnecessary.

What was actually exposed

The numbers matter because they set the blast radius, and because they are not estimates. Each came out of an endpoint the researcher could enumerate.

AssetScaleWhy it matters
Customer directory748,000 usersTarget list, and the input to every other step
OTP store2.5M codes, back to 2021Defeats the second factor without touching the phone
Uploaded documents76,000 filesAadhaar and licence images, reusable for identity fraud
Tracked vehicles676,000Real-time position and telemetry for commercial fleets

Fleet telemetry is a different category of exposure from a normal credential dump. A leaked password is a problem for the account holder. Live truck positions across a national commercial fleet is route intelligence: which vehicles carry high-value cargo, when they stop, where they are unattended. Cargo theft crews do this reconnaissance the hard way. This would have handed it over as an API response.

Why did disclosure take twenty months?

The timeline is the second story here, and it is a familiar one.

  1. Nov 3, 2025Initial report sent to the vendor full technical detail on the unauthenticated endpoints
  2. Nov 10-17, 2025Repeated follow-ups after no reply no acknowledgement from VE Commercial Vehicles
  3. Nov 20, 2025Primary vulnerability patched fix shipped without a response to the reporter
  4. Jul 27, 2026Public disclosure researcher reports secondary issues were never adequately addressed

Seventeen days from report to patch is respectable engineering. Eight months of silence around it is not, and the researcher is explicit that the secondary concerns raised across multiple contact attempts went unresolved. That pattern, fix the headline bug and stop reading the email, is exactly what turns a coordinated disclosure into a public one.

RelatedSimpleHelp Auth-Bypass Flaw Threatens MSPs at CVSS 10

Who is affected, and what should they do?

Anyone who has held a My Eicher account since 2021 should assume their profile data and any documents they uploaded were reachable during the exposure window, and that a stored OTP tied to their account existed in a readable database. Rotate the password, and treat identity documents submitted through the platform as disclosed rather than merely at risk. Aadhaar and licence images do not expire the way a password does, which is the part that cannot be remediated by a patch.

For anyone running a connected-vehicle or telematics platform, the transferable lesson is narrower than "add authentication." Every one of these endpoints presumably had authentication at the route the app called. The gap was the parent path, the layer above, the one nobody thought of as an endpoint because no client ever requested it. Enumerate upward from your own client's URL tree and see what answers.

What to watch
  • Regulatory response in India. Aadhaar numbers in a breach engage the DPDP Act and UIDAI. Whether either acts on a disclosure with no CVE and no attributed exploitation is the open question.
  • Whether the secondary issues get fixed. The researcher says they were not. A second writeup is the usual outcome when a vendor stops replying twice.
  • Copycat findings across telematics. Parent-path enumeration is cheap to test and this is now a published recipe. Expect similar findings on other regional fleet platforms within months.
  • Evidence of prior abuse. No exploitation has been attributed. With no authentication on the endpoints, the logs that would prove or disprove it may not distinguish an attacker from a user.

Our take

Nothing here required skill, and that is the finding. No memory corruption, no clever chain, no zero-day: a researcher deleted parts of a URL and the server answered. Storing 2.5 million one-time passwords in a readable table is the sort of design decision that only survives because nobody outside the team ever looked, and it sat there for at least four years.

Connected commercial vehicles have quietly become critical infrastructure, and the software around them is still being built to the standard of a customer portal. A platform tracking 676,000 trucks in a national economy should be threat-modelled like a logistics control system, with the identity documents treated as the crown jewels they are. The patch closed the door. The eight months of silence around it, and the secondary issues the researcher says are still open, tell you the process behind the door has not changed.

Primary sources

Original analysis by GenZTech, based on the researcher's published disclosure. Source: eaton-works.com