A hacker helped uncover Tesla data that led to the company losing a $243 million lawsuit

A high-profile lawsuit against Tesla took an unexpected turn. An independent cybersecurity researcher who had worked with the company for years under its vulnerability disclosure program managed to recover data from a wrecked car that had been considered lost. Those records became one of the key pieces of evidence in a case that ended with a court ordering Tesla to pay the victims about $243 million.

The crash that changed perceptions of Autopilot

The tragedy took place on April 25, 2019, in Florida. The driver of a Tesla Model S was traveling with Autopilot enabled. At that moment, he became distracted by his phone, and the car veered out of its lane at high speed and slammed into a parked Chevrolet Tahoe, beside which two people were standing.

22-year-old Naibel Benavides died at the scene, and her boyfriend Dillon Angulo suffered serious injuries. Later, this case became the first time a U.S. federal jury found the Autopilot system partially responsible for a fatal crash.

The lost data turned out not to be lost

During the proceedings, Tesla argued that some telemetry and vehicle data were missing or damaged, so the full picture of the crash could not be reconstructed. However, the victims’ lawyers decided to bring in an independent cybersecurity specialist known by the pseudonym Green.

The researcher has been studying Tesla vehicles’ internal systems for many years. He previously took part in the company’s official Bug Bounty program, through which Tesla paid rewards for discovered vulnerabilities — up to $15,000 for one critical flaw.

During the forensic examination, the specialist managed to extract information directly from the car’s computer. Recovering the data took about five hours.

What the examination showed

The recovered records disproved the assumption that the car had “seen nothing.”

According to the restored data, the system recognized the edge of the road, a STOP sign, a parked SUV, and people near it. However, Autopilot did not warn the driver of the danger or initiate emergency braking, even though it had the necessary information to analyze the road situation. These data became some of the most convincing evidence for the jury.

The court’s decision

After several weeks of proceedings, the jurors concluded that responsibility for the crash did not lie solely with the driver.

Tesla was found 33% liable, as the driver-assistance system was deemed insufficiently safe for such operating scenarios. The total amount of compensation and penalty payments came to about $243 million, including $200 million in punitive damages. The company has already said it intends to appeal the ruling.

Why this case became significant

The story showed how important digital forensics and independent information security specialists have become today.

A modern car is a complex computer on wheels that continuously records a huge amount of data: the driver’s actions, sensor performance, cameras, radar, and driving-assistance algorithms. Even if some information is considered lost, specialists can often recover it directly from the memory of electronic control units.

This process is similar to recovering deleted files from a hard drive: data may remain in the device’s memory even after deletion or damage to the logical structure.

Bug Bounty — why automakers pay hackers

The Bug Bounty program has long become an industry standard among the largest technology companies. Instead of fighting independent researchers, companies officially pay them for discovered vulnerabilities.

Tesla was one of the first global automakers to launch such a program. Thanks to this, specialists around the world help identify errors in vehicle software before attackers can exploit them.

Ironically, it was the experience the researcher gained during his years of cooperation with Tesla that later allowed him to recover the data that played a key role in one of the company’s most high-profile court cases.

What this means for the industry

Experts believe the case could become an important precedent for the entire autonomous transport industry. In legal disputes, digital evidence that records every action of a vehicle down to the millisecond will now matter more and more, rather than the parties’ statements.

For manufacturers, this means tighter control over driver-assistance technologies, and for users, a reminder that even the most advanced systems remain only assistants and do not replace full human control behind the wheel.