> The response contained the victim's name, phone number, address, and car details.

Sweet baby Jesus. Companies need to be held accountable and punished severely for these types of leaks.

Probably too much entropy with VIN numbers but could imagine brute forcing to activate as many vehicles as possible as fast as possible

VINs are generally visible from outside the car (on the dashboard). That means until this was fixed you could walk up to a car, read its VIN, and remotely unlock & start it.

Wow, who woulda thunk that Sirius XM would be the player here...

> We reported the issue to SiriusXM who fixed it immediately and validated their patch.