Intoxalock

Summary

Intoxalock experienced a cyberattack that disabled its ignition interlock devices, leaving numerous drivers unable to start their vehicles and stranded. The attack disrupted the company’s servers, preventing required device calibrations and prompting reports of vehicles becoming inoperable. Affected users alleged that the outage caused property loss, missed work, and additional expenses such as towing fees. Lawsuits filed against the company claim it failed to implement adequate security measures, including encryption and multifactor authentication, which allowed unauthorized access to its network and customer data. The litigation has been paused while the company conducts an incident response investigation to determine the full scope of the breach and the number of impacted customers.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In mid‑March 2026 Intoxalock, the Iowa‑based maker of ignition interlock devices, announced on its website that its systems were experiencing downtime after a cyberattack that began around March 14. The company said it had temporarily paused some of its systems as a precautionary measure. Because the breathalyzer devices require periodic calibrations that depend on a connection to Intoxalock’s servers, the downtime prevented users from completing required calibrations and left many vehicles unable to start. Drivers across the United States reported being stranded, with some describing their cars as giant paperweights.

In March 2026 attorneys for Derrick Curry of Worth, Illinois, and four other individuals filed separate federal lawsuits against Consumer Safety Technology, which does business as Intoxalock, in the U.S. District Court for the Southern District of Iowa; a similar suit was later filed by Robert Million of Crystal, Minnesota. The lawsuits allege that Intoxalock failed to secure its information technology network, lacked encryption, multifactor authentication and timely software patches, allowing unauthorized third parties to hack the system in March 2026, disable the ignition interlock devices and steal customer data. The plaintiffs claim resulting injuries include loss of property, loss of vehicle use, lost wages, and, in Curry’s case, unexpected towing costs, missed work, termination of employment and subsequent spam emails and calls. The initial five suits were consolidated into a single case, and on July 31 2026 a federal judge granted Intoxalock’s request to stay the proceedings while the company completes an extensive incident response investigation, setting the next possible court date for February 1 2027.

Intoxalock told affected customers that it was offering 10‑day extensions on required calibrations because of the cybersecurity disruption and, in some cases, arranging towing services to help drivers whose vehicles remained immobilized. One plaintiff, Derrick Curry, alleged that his vehicle shut off while he was driving, forcing a tow that cost more than $700, that the device remained nonfunctional the next day causing him to miss work and be fired, and that he later paid $300 to have the device removed after receiving spam emails and notices of a fraudulent loan application in his name. The company has not disclosed the type of cyberattack, whether ransomware was involved, or if any ransom demands were received, and it continues to investigate the full scope of the data breach and the number of customers impacted. As of the July 31 stay, Intoxalock reported that its investigation was ongoing and that it remained open to settlement discussions once the extent of the impact is known.

Sources

Sources available to members: 3 sources.