Tesla Inc says Shanghai factory not hacked

United States electric vehicle maker Tesla Inc said today a hacking incident reported on Tuesday did not affect its Shanghai car factory and was restricted to a supplier’s production site in central China’s Henan Province.

A small group of hackers earlier this week viewed live and archived surveillance footage from hundreds of businesses by gaining administrative access to cameras supplied by Verkada, one of the hackers said on Tuesday.

Verkada acknowledged an intrusion, saying it had disabled all internal administrator accounts to prevent unauthorized access. “Our internal security team and external security firm are investigating the scale and scope of this issue, and we have notified law enforcement” and customers, it said on Tuesday.

Swiss software developer Tillie Kottmann, who has gained attention for finding security flaws in mobile apps and other systems, shared recordings allegedly from inside a Tesla factory in China and a showroom in California.

In a statement, Tesla China said the hacking incident only involved one of its suppliers’ production sites in Henan and neither its Shanghai car factory nor showrooms were affected.

It also said data from the supplier’s factory was stored locally and there was no security risk mentioned in the hacking incident. It has stopped the cameras in the supplier’s factory from working or linking to the Internet.

The hacking group, if it had chosen, could have used its control of the camera gear to access other parts of company networks at Tesla and software makers Cloudflare Inc and Okta Inc, according to Kottmann.

Cloudflare said its security measures were designed to block a small leak from becoming a wider intrusion, and that no customer data were affected.

Okta said it was continuing to investigate but that its service was not affected.

Verkada says on its website it has over 5,200 customers, including cities, colleges and hotels. Its cameras have proved popular because they pair with software to search for specific people or items. Users can access feeds remotely through the cloud.

In a 2018 interview with Reuters, Chief Executive Filip Kaliszan said Verkada had deliberately made it easy for many users at an organization to watch live video feeds and securely share them, such as with emergency responders.