We take the issue of Toyota and Lexus vehicle theft very seriously. We are continuously developing technical solutions to make our vehicles more secure, to help reduce the risk of theft.
An enhanced security hardware system was introduced in October 2021 on the latest models targeted by criminals. Since which, we have seen a significant drop in thefts of those models.
For older models, we endeavour to create solutions that can offer enhanced protection to our customers. Following significant investments by Toyota GB, in line with that of other vehicle manufacturers, newly developed official Toyota and Lexus security hardware components will very soon be available to fit to those targeted models registered before October 2021.
Following communication from Lexus in the coming weeks, owners should contact their local dealer to arrange free of charge fitment. Customers can already speak to their local dealer about the fitment of a protective plate to block access to the vehicle’s electronics. This is a nationwide customer care offering.
As a vehicle manufacturer, we can never completely eliminate the risk of vehicle theft. This is an industry-wide issue, concerning all vehicle manufacturers and affecting the most popular models first.
In order to further reduce the theft risk, we regularly collaborate and share information with insurance associations, police and law enforcement authorities, theft prevention experts and other key stakeholders around the world. This enables us to understand new threats and techniques used by thieves and develop more secured systems.
Alongside our efforts, we urge those authorities to focus on reducing the number of thefts. We would also like to see action taken that leads to the end to the online sale of devices used by criminals to steal cars without using the car keys, as these devices serve no purpose other than a criminal one.
How do thieves manage to steal cars this way?
The thieves disconnect part of the headlamp and use a malicious device to send signals to the control CAN bus (the communication ‘backbone’ within a car) that allow the doors to open and the car to start without the key or remote control.
Thieves need to:
- Purchase a relatively expensive rogue device (third-party ‘emergency start’ device which costs around £2,500 – £4,000 each)
- Gain physical access to the vehicle’s CAN bus communication wires for an uninterrupted period.
The third-party ‘emergency start’ device has the capability to initiate an exploit in the following manner:
- Once connected to the vehicle’s CAN bus communication wires, the third-party ‘emergency start’ device can send a prioritised series of CAN signals to bypass the vehicle’s security and immobiliser systems, which could allow a thief to unlock the doors and turn the vehicle’s ignition ON.
- The third-party ‘emergency start’ device is then disconnected.
- At this point a thief can enter the vehicle and start the car without the key
What is Lexus doing to prevent these types of attacks?
Lexus takes the issue of car theft very seriously. We are continuously developing technical solutions to make our vehicles more secure to help reduce the risk of theft.
In the UK market, an enhanced security hardware was introduced in October 2021 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
For older models we endeavour to create solutions that can offer enhanced protection to our customers. We cannot divulge the precise nature of the imminent security enhancement; should we do so we risk offering information into the public domain that could be of interest to criminal parties.
The intention is to make the security enhancement available to all vehicles where a countermeasure is available.
In October 2021 (introduction of NG NX), a new security platform started to be rolled out. There are no reports of theft using the CAN bus injection method on any model with the new platform.
What models are known to be targeted by this issue and are newer models affected?
The model primarily targeted is the Lexus RX Gen 4. Other models have also been targeted.
Which Lexus models can be fitted with the enhanced security feature?
It can be fitted to previous generation RX, NX, plus ES, LC, LS, RC, GS, UX and UXe
When did Lexus first become aware of the vulnerability in the security system?
It is not so much vulnerability of the security systems but more so the growing rise in criminal gangs targeting vehicles for ‘cannibalisation’ and / or complete theft. Instances appear to have been rising significantly from 2019-2020. There are many factors involved and at a global level. This includes parts of the world experiencing parts shortage which results in targeted thefts to supply vehicles and/or parts sent to countries experiencing trade restrictions.
When is the enhanced security upgrade going to be available and will it be free of charge?
Exact timings are still to be confirmed. We anticipate being able to advise the Lexus Centre network with full details soon. The required enhancement needs to be carried out at a Lexus Centre. Costs are under review and customers may incur a nominal charge.
Are new models such as the LBX targeted by thieves?
While no car can be considered 100% immune to criminal intent, more recent models are equipped with enhanced security systems aimed at deterring CAN bus type thefts.
Given that the rise in this type or car theft has been known for several years in other countries and is growing in the UK why wasn’t I told about this?
Lexus takes the issue of car crime very seriously. To protect customers’ vehicles our approach is not to disclose our vehicle theft analysis data. The sharing of information could enable thieves to find ways to circumvent anti–theft technologies or make some models particularly attractive to some thieves and unnecessarily vulnerable to attack.
Why are Lexus owners not being invited to install protective plates to their vehicles and why were they only supplied to London Centres?
Lexus offers a free of charge VPP (Vehicle Protection Plate) to any RX450h customer. Every Lexus Centre across the UK has access to this part. Parts were issued to London Centres in the first instance in line with where the demand has occurred, but all Centres can order the VPP. The strategy is however, to focus attention not to the roll-out of the VPP but to a sophisticated vehicle enhancement.
What is the countermeasure and the plan moving forwards?
We are continuously developing technical solutions to make our vehicles more secure and reduce the risk of theft. An enhanced security hardware was introduced in October 2021 on the latest versions of the models that had previously been targeted by criminals. Since then, we have seen a significant drop-off in terms of successful thefts of those models.
Also we are able to supply and fit a VPP (Vehicle Protection Plate) to targeted RX models
We endeavour to make available another solution that can offer enhanced protection. Details will follow in the coming weeks. This will be communicated to the Lexus Centre network, which will also be responsible for fitting the enhanced security solution.
Why is there no recall for vehicles susceptible to the CAN bus attack?
Recall announcements in the UK are guided by very specific guidelines as drawn up by Driver and Vehicle Standards Agency (DVSA). To qualify as a recall, the issue must relate to a safety or thermal type issue where there is potential for injury as a result of vehicle manufacture or component failure. Only in these such circumstances can a recall be announced.
In recall circumstances, the DVSA will provide manufacturers access to ownership records for purpose of communication. Instances of theft do not trigger a recall.
Will Lexus pay for damage caused by an attempted theft?
No. This will need to be addressed by the customer and the vehicle insurers. While we understand theft or attempted theft can be highly upsetting and, in some cases, a costly experience, in such instances customers are first and foremost victims of crime. Lexus does not cover costs associated with criminal activity either under the terms of the warranty or as goodwill.
What is the position with insuring affected models?
As a manufacturer, we stay close to Lexus Insurance colleagues and indeed all motor insurers. We are aware that in many cases, insurance premiums might have increased as a direct result of vehicle crime. We need to refer you to your insurer for further comment.
I own a CT200H (WX14XYR).
Is this model affected by the CAN bus vulnerabilities common to Toyota and Lexus and the reason why we are having problems with insurers when trying to insure a Lexus?
Would like to know, please, if this fitment would be possible to get on a CT200H and also if a CAT LOC is fitted or can be fitted in my car.
I understand you are rolling this out to affected models first, but given this is preventive, will this be available to other Lexus models that are equally vulnerable to this crime (enhanced security and protective plate)?
Hi Bruno
CT200H is not affected by CAN theft.
Not sure how to answer the insurance question, it may be due to the CAT thefts, but only they can advised on this.
A CAT LOC can be fitted to this vehicle.
Kind regards
Thank you. As above I spoke to the Bolton Service Centre on Monday this week and they could not help as they were not sure of the process which was disappointing. Will have to see what they say on Monday.
I called into Lexus Hedgend in Southampton today the 18th April and was informed that they had not been issued with the protective plates as yet and to give them a call in a couple of weeks
Hi,
I part-exchanged my Gen 3 RX and purchased a 2018 RX Sport in December not knowing about the security flaw in the Gen 4. If I had realised I would of gone for another brand. Lexus Hedge end fitted the plates a couple of weeks ago and when asked about a security software update they were none the wiser. When is this security update being issued as in the original statement it was “end of April”?
Hi Matt
I am surprise to learn Lexus Hedged end is not aware of this as all of the Network have been advised.
They may mean they are not aware of the when the security update is available?
Once there is further information they will be able to update you.
Kind regards
I, parked my car (Lexus RX450) near my house and there was an attempt of theft they broke the left side panel where the headlights and tyre side were, and they broke all the clips as well. I spoke to Hayes Toyota services centre who said to speak to Lexus about this issue.
I am looking for assistance with this issue.
Many Thanks.
Regards,
M Adnan
Hi Muhammad
May we have your vehicles registration and we can raise this with Hayes. May we ask what assistance you require?
Kind regards
You need a visible deterrent until Lexus have installed the security update that their post-Watchdog statement referred to, to almost all at-risk cars.
As owners none of us are protected from bumper/wheelarch damage and/or theft until the forthcoming security update has been rolled out to most of the Lexus fleet.
You say Lexus wont cover the cost of damage or make a goodwill contribution.
With respect, those of us that are consumers have legal redress and you are supplying vehicles are of unsatisfactory quality, the ES may as well not have locks on an doors since it is one with very little effort the wiring system can be accessed from the front bumper – this is a serious design flaw. We will leave the issue of what Lexus has to pay to the court to decide. In the meantime please provide the postal address for service of court proceedings and an email address.
Hi Dan
We can see that you already have a Customer Relations case open with us so we will continue to communicate through this channel.
Kind regards
Thanks Lexus for being open and transparent. All the best ! It’s very difficult in a tech savvy world.
I had a Lexus UX stolen about a fortnight ago from outside my house. I was not told about the CANbus security issue either when I bought the car or subsequently even though Lexus was obviously aware of this issue. Whilst I love Lexus cars I feel I have been let down and information that would have made a difference in my choice of vehicle was withheld from me. I would be interested to know if anyone was thinking of taking legal action against Lexus or class action as I imagine there are a lot of people affected.
I am looking to purchase a car to replace the one that was stolen and had been looking at a Lexus NX (used 2018 model) until I found out about the security issue by overhearing some people talking on the forecourt. The dealer at Edgware Rd subsequently told me there are no additional safety measures at present for this model. Is this correct? Unfortunately I would not purchase a used Lexus unless / until additional safety measures are introduced. As I need a car this means that I will have to look at other options (BMW / Audi / Volvo) which is a shame as I much prefer Lexus.
Hi Jonathan, thanks for your comment.
We’re really sorry to hear that your Lexus UX has been a victim of CANbus theft. You are correct in that there is currently no further security update available, although this is something that we are currently working on.
Thanks,
Lexus UK
Hi, i just had my lexus stolen 2 nights ago! After only having it 3 months i am distraught. I have only just come across these articles and learnt about the issues. Ji was told by the dealership that these cars are very secure which now i know not to be the case. I want to understand what Lexus are goinf to do to now support me with my loss as this js unacceptable
Hello Aasi,
We are terribly sorry to hear that you have been affected by this awful crime.
While we understand theft can be highly upsetting and, in some cases, a costly experience, in such instances customers are first and foremost victims of crime.
Lexus does not cover costs associated with criminal activity either under the terms of the warranty or as goodwill.
Once again, we are really sorry that you have been affected by this horrible crime and for any distress this has caused.
Thanks,
Lexus UK
It’s disgraceful that Lexus have done nothing about this problem. My UX was stolen two months ago.
Hello Anna,
We are terribly sorry to hear that you have been affected by this awful crime. Please be assured this is a matter that we are taking extremely seriously.
We are continuously developing technical solutions to make our vehicles more secure and reduce the risk of theft.
Once again, we are really sorry that you have been affected by this horrible crime.
Thanks,
Lexus UK
Today I received notification from my insurance company that they will not be renewing my car insurance upon expiration of the policy . This
is they claim due to the high number of stolen RX450h’s . I have one
that is just over a year old having moved from a succession of Jaguar’s.
I never had any problem getting those insured. I am looking for help
so I can remain with Lexus .
Hi Alan, thanks for your comment.
We’re really sorry to hear this. A lot of insurance providers are having to take further precaution in order to be able to insure vehicles deemed at risk.
Fitting a secondary immobiliser is usually what is being requested, your local Lexus Centre may be able to assist with a local provider of this.
Thanks,
Lexus UK
Thank you for your reply . The serious design fault in the location of the canbus is one problem . The second problem by the mere fitting of a third party second immobiliser does not prevent damage caused by an attempt to access the canbus as is illustrated here. ‘Link removed’
It is disappointing of some note that thefts of RX’s have to get to such a level that insurance companies are unwilling to offer insurance cover e.g LV and Allianz for starters before Lexus belatedly talks obliquely about a protection cover . I assume this also comes with a large windscreen sticker stating “ Canbus Protection Cover Fitted don’t bother trying to break into the left wing !”
I will discuss the whole matter with my local Lexus dealer who will be picking up the bill for what can only be described as a highly compromised product .
Is the 23 model RX 350h vulnerable to canbus theft? We just had an attempted theft of our vehicle and disrupted them in the process and they fled but wonder if they will come back? Our 19 model was stolen last year via canbus theft.
Hi CL, thanks for your comment.
We’re so sorry to hear this. Yes, your RX is likely to be susceptible to CANbus theft. If you’d like to get in touch with your local Lexus Centre, there is a vehicle protection plate availbale for this vehicle.
Thanks,
Lexus UK
I’d strongly suggest a visible deterrent would be most useful – a steering lock or even a sticker warning the canbus plate has been fitted . The plate will help stop theft, but thieves may damage your car in the process as there is no sign it’s been installed.
Hi, I want to confirm if the Ux is affected by these canbus thefts?
My plate is HV20***.
If it is affected, what are the other things I could do to prevent theft?
Hi M.A, thanks for getting in touch.
Your vehicle is deemed as vulnerable to CANbus theft. We are asking people to get in touch with their Lexus Centre so that they can be notified by their Lexus Centre when this security enhancement is available.
To prevent theft you may wish to look at our Car Security Tips here – https://mag.lexus.co.uk/car-security-advice-and-tips/
Thanks,
Lexus UK
Hi Lexus team.
The sales representative whom I spoke to, upto oaying and picking the car up told me the Ux has no issues. Is there anything in place to deter thieves?
I think I might just return and swap back to my CT. I have been lied to and this is not fair. I asked before buying and your sales advisor told me there are no known issues
Hi M.A,thanks for the reply.
We would suggest speaking to your Lexus Centre to follow this matter up.
Thanks,
Lexus UK
Despite registering with Lexus UK and with my local dealer for the ‘April solution’ for my LC500 I’ve had no communication from anyone.
I assume therefore the ‘solution’ does not yet exist.
Until every single affected UK car is protected we are all at risk of the damage resulting from attempted canbus theft.
Lexus stepping up to the plate and investing £100-200 per car on a countrywide immobiliser installation campaign would surely be quicker?
As I’m reading that increasing numbers of us are finding insurance premiums either massively increased or renewal with existing insurers refused point blank when will the solution be ready?
If owners can’t insure the cars they are effectively worthless once the problem is as well publicised as the Lexus problem is now – see Land Rover values for how well that will turn out.
Hello Andy,thanks for getting in touch.
There is no information available on the security enhancement just yet.
Once an update is available we will be contacting the Lexus Centres and also any customers asking us to reach out to them directly.
We are grateful for your patience on this matter.
Thanks,
Lexus UK