Toyota and Lexus owners could be owed compensation as some keyless vehicles found to be vulnerable to a device which allows them to be stolen in minutes

The issue, which recently gained attention on BBC Watchdog, relates to a device used by thieves to hack into part of the vehicle’s computer system known as the Controller Area Network (CAN). The device, known as a CAN Invader, allows thieves to quickly override the vehicle’s security, gain access to the locks and ignition and drive the car away, usually without causing any damage.  

The ease of accessing vehicles using this device, which is often deployed in an area near the front wheel, has resulted in a sharp increase in thefts of certain Toyota and Lexus models. 

According to research by the law firm Leigh Day, more than 120,000 Lexus and Toyota vehicles fitted with a smart key have been sold in the UK since 2012 and may be vulnerable to the CAN Invader device. 

Models affected include: 

• Toyota Land Cruiser 150
• Toyota RAV4
• Toyota C-HR
• Lexus LC / LC-C
• Lexus RC
• Lexus RX / RX L 450h
• Lexus ES
• Lexus ES
• Lexus GS / GS-F
• Lexus NX
• Lexus LS
• Lexus UX / UXe

Lawyers at Leigh Day are now investigating a potential group legal claim for compensation against Toyota/Lexus on behalf of vehicle owners for breach of contract and consumer rights legislation.  

One owner affected by the issue, Declan Kelly from London said: 

“Our Toyota Landcruiser was originally taken in March 2023. It was recovered within a few hours as we had fitted an aftermarket tracker. When I played back the CCTV I could see that the thieves used some sort of device to start the car via the front wheel arch. I went online and learned about CAN invaders. I immediately reached out to Toyota (GB) PLC and asked if they had developed security measures to protect against this device. The car was stolen again a few weeks later despite us fitting a steering wheel lock. It was recovered again via the tracker but this time the thieves had caused £8000 worth of damage to the interior whilst searching for the tracker.  

“Since then, there have been two further attempts to take the car and whilst it’s now impossible to drive it away the front wheel arch sustains damage each time they attempt to use the CAN Invader. I can’t understand why Toyota didn’t notify owners that they had a security issue. These things happen and I would happily have spent a few hundred pounds on extra security rather than have to endure the hardship and anxiety of having the car repeatedly stolen and broken into. We want to get to the bottom of these security issues and understand why insurance companies and car security rating services did not highlight these potential problems when we researched the vehicle and continue not to reflect this information in the ratings.” 

According to the police, the only way not to stop these kinds of thefts is to armour plate the wheel well or to use steering locks, although the latter can be cut through by thieves. Engine immobilisers may also offer a solution.  

In 2022 Toyota/Lexus said it had been monitoring keyless vehicle theft for some time but, to date, the manufacturer has not offered a solution to the issue. 

Leigh Day partner Gene Matthews said:

“The fact that such high value vehicles are so vulnerable to theft using a cheap tech device has left many owners fearing what might happen to their Toyota or Lexus. Instead of alerting owners to the problem and recalling vehicles to have it remedied, Toyota/Lexus has sought to keep the issue quiet and avoid having to fix the problem and avoid an expensive recall of thousands of vehicles. Anyone who owns one of the affected models should consider joining this claim for compensation for the worry and inconvenience this issue has caused.”

If you have owned or leased a Toyota or Lexus vehicle from 2019 onwards and have been affected by this issue, then you can contact us via our expressions of interest form. Alternatively, you can contact canbusenquiries@leighday.co.uk.