A Canadian man who recently sold his 2017 Cadillac Escalade was surprised to see that his old vehicle remained connected to his MyCadillac smartphone app even after it had been purchased by someone else, allowing him to control a complete stranger’s vehicle from more than a thousand miles away.
This story, which was first picked up by the French-speaking CBC Radio-Canada, involves a former GM customer named Gilles Veilleux. The Quebec-based car enthusiast purchased a third-generation Cadillac Escalade in 2017 and promptly connected the vehicle with the OnStar-developed MyCadillac smartphone app, which allows the user to turn the vehicle’s ignition on and off remotely, receive updates on the vehicle’s maintenance intervals and even request roadside assistance. The app also includes a geolocation feature, allowing the user to track their vehicle’s movement in real-time, similar to how fleet tracking software operates.
Veilleux sold his 2017 Cadillac Escalade last summer and had forgotten that the vehicle was still connected to the MyCadillac app. When he opened the application, he was surprised to find that he still had full control of the vehicle through MyCadillac, allowing him to see the vehicle’s location and switch the ignition on and off, among more. When he opened the app, he saw the vehicle was driving on the highway in the United States with its new owner presumably behind the wheel.
Shocked at this discovery and realizing the potential for this oversight to be leveraged by bad actors, Veilleux contacted Radio-Canada to raise the alarm bells. The CBC then sent reporters to meet the new owners of the Cadillac Escalade in St. Louis, Missouri, Ronald Fraction and Markeyta Williams, where they had Veilleux demonstrate the control he had over the vehicle. With the new owners looking on, Veilleux powered up the MyCadillac app and turned on their vehicle’s engine all the way from Beauce, Quebec – which is located more than 1,200 miles away from St. Louis. Not surprisingly, Markeyta Williams found this turn of events “terrifying.”
CBC reporters later contacted GM Canada for comment, with a spokesperson explaining that it’s the owner’s responsibility to inform GM that they’ve sold the vehicle and to delete the app after the transaction is complete. While reading the fine print on smartphone applications is advisable, it’s safe to say that few people who use such applications do this. With countless GM vehicles on the roads capable of using the MyCadillac, MyChevrolet, MyBuick and MyGMC apps, it’s highly likely that other GM owners are unknowingly driving around in a car, crossover, truck or SUV that’s connected to someone else’s phone.
Thanks to the CBC’s reporting, the Fraction-Williams family was able to get in contact with OnStar and remove Veilleux from the account. Likewise, concerned owners of modern, second-hand GM vehicles can also reach out to OnStar to ensure their vehicle is not connected to the previous owner’s application. Issues such as these may become more commonplace in the future, as roughly 50 percent of all new vehicles produced have similar connected features, the CBC report says. This number is expected to rise to around 95 percent by 2030, as well.