Investigations

Hyundai and Kia Sold Millions of US Cars Without the Engine Immobilizer Fitted to the Same Models in Canada and Europe. The Fix Was a Software Update Requiring the Key to Be in the Ignition, and a Steering Wheel Lock From the Police.

An engine immobilizer is a small electronic check. A chip in the key sends a code, and the engine will not run unless it receives the right one. By the 2015 model year, according to the Insurance Institute for Highway Safety's Highway Loss Data Institute, passive immobilizers were standard on 96 percent of vehicle series sold in the United States by every manufacturer other than Hyundai and Kia. For Hyundai and Kia, the figure was 26 percent. In 2000, the rest of the industry had already been at 62 percent.

The missing part was not missing everywhere. Canada had announced in 2005 that every passenger vehicle sold there from 2007 would need one, and automakers told Canadian regulators at the time that it cost less than $30 Canadian per car. When the attorneys general of 17 states and the District of Columbia wrote to federal regulators in April 2023, they noted that between 2011 and 2022 the companies had left out anti-theft devices that were standard on almost every other new car, "including the same Hyundai and Kia models sold in Canada and Europe." Hyundai made immobilizers standard on all of its US vehicles built after 1 November 2021. That left roughly a decade of keyed-ignition Hyundais and Kias on American roads, waiting for someone to notice.

The Tutorial

Someone noticed in Wisconsin. According to HLDI, stealing these vehicles became a social media trend in 2021, "as car thieves began posting videos of their thefts and joyrides and even videos explaining how to steal the cars." The method required no technical skill and very little equipment: break a window, tear apart the steering column, remove the ignition lock, and turn what remains with the end of a standard USB cable. The videos were collected online under the name of the "Kia Challenge".

In Wisconsin, where the thefts first became common, Hyundai and Kia theft losses in 2021 were more than 30 times their 2019 level. As the trend spread east, police in Grand Rapids, Michigan, counted nearly four thefts or attempted thefts a day between 1 May and 7 July 2022. "Some vehicles may be targeted because they're fast or worth a lot of money and others because they're easy to steal," HLDI's Matt Moore said in September 2022.

The Insurers

Insurers do the arithmetic before anyone else. In January 2023, State Farm said it had "temporarily stopped writing new business in some states for certain model years and trim levels of Hyundai and Kia vehicles because theft losses for these vehicles have increased dramatically." Progressive, which also stopped writing some new policies, said it had seen theft rates for certain models "more than triple," and that in some markets "these vehicles are almost 20 times more likely to be stolen than other vehicles." CNN reported that the affected cities included Denver and St. Louis.

HLDI kept counting. In the second half of 2023, model year 2003–23 Hyundais and Kias generated 11.7 theft claims per 1,000 insured vehicle years. All other makes combined generated 1.4. The Hyundai and Kia rate was more than eleven times what it had been in the first half of 2020. Vandalism claims, which is what an unsuccessful theft leaves behind, had risen sixfold.

The Patch

In February 2023, the companies announced their fix: a free software upgrade for about 8.3 million US vehicles, 3.8 million Hyundais and 4.5 million Kias. The update, Insurance Journal reported, "extends the length of the alarm sound from 30 seconds to one minute and requires the key to be in the ignition switch to turn the vehicle on." Hyundai added a window sticker alerting would-be thieves that the car now had anti-theft protection. By then, the National Highway Traffic Safety Administration said, the thefts had been linked to at least 14 crashes and eight deaths.

Not every car could take the software. For those, the companies had distributed more than 26,000 steering wheel locks since November 2022, through 77 law enforcement agencies in 12 states. The attorneys general observed that the locks placed "additional burdens on owners" and did "not address the underlying ignition system flaw." So a car that could be started without its key was corrected, after a decade, by a software update telling it to wait for the key, and owners who could not get the update collected a steel bar from the police station.

The Regulator

The attorneys general asked NHTSA in April 2023 to order a recall of affected 2011–22 models. NHTSA declined. Its reasoning, as reported by Vice, was that "the safety risk arises from unsafe use of a motor vehicle by an unauthorized person after taking significant destructive actions to parts of the vehicle." The US theft standard, an agency spokesperson explained, "does not contemplate actions taken by criminal actors." It requires a key for normal operation. The Canadian standard, by contrast, lists the tools an immobilizer must resist, including screwdrivers, hammers, wire cutters, angle grinders and battery-operated drills, and requires it to hold out for at least five minutes. A USB cable is not on the list. It did not need to be.

The Settlements

The class actions began in June 2021, before the videos went national. On 25 October 2024, a federal court gave final approval to a settlement covering about nine million 2011–22 vehicles, with a fund of between $80 million and $145 million. Owners whose cars were totalled could recover up to 60 percent of Black Book value. Deductibles and premium increases were reimbursed up to $375 per incident. Class counsel received $13,403,485.60 in fees. The settlement documents noted that "the Software Upgrade does not guarantee any vehicle will not be subject to theft or attempted theft." Hyundai and Kia denied the allegations and said teenage criminals had caused the thefts.

On 16 December 2025, 36 attorneys general announced a separate $9 million settlement. Half was set aside as restitution for owners whose cars were stolen or damaged after 29 April 2025, half went to the states for the cost of the investigation, and the companies agreed to offer free zinc-reinforced ignition cylinder protectors, a physical sleeve around the part the USB cable had been turning, to owners of eligible cars, including those previously offered only the software. According to the states, thieves had found ways around the 2023 update. "Hyundai and Kia could have made their cars harder to steal from the outset – but they chose not to," said North Carolina Attorney General Jeff Jackson. The companies also agreed to fit industry-standard engine immobilizers to every future vehicle they sell in the United States.

The cities came last. Columbus, Ohio, which sued in February 2023 when nearly half of all cars stolen in the city were Kias and Hyundais, announced a settlement worth about $1 million in September 2026. City Attorney Zach Klein said the money would "pay for overtime in the policing budget." Hyundai said it "remains committed to supporting customers."

The part cost less than $30 Canadian in 2005, and it was already in the same cars north of the border. In the United States, it arrived in the form of a software patch, a steering wheel lock, a zinc sleeve, a class settlement, a multistate settlement and a municipal overtime refund, and finally as a written promise to include it in the next ones.

Filed from public reporting:

Hyundai and Kia Sold Millions of US Cars Without the Engine Immobilizer Fitted to the Same Models in Canada and Europe. The Fix Was a Software Update Requiring the Key to Be in the Ignition, and a Steering Wheel Lock From the Police.

The Tutorial

The Insurers

The Patch

The Regulator

The Settlements

Read more

Apeel's Grape Seed Coating Once Kept Six in Ten American Supermarket Avocados From Spoiling. Then the Internet Found the Safety Data Sheet for a British Degreaser Also Called Apeel.

A Texas Power Company Charged $9.99 a Month to Let Customers Pay Exactly What the Wholesale Market Paid. In February 2021 the Market Paid $9,000 a Megawatt-Hour, and Griddy Drafted It Straight From Their Accounts.

Australia Paid Up to $1,600 a Home in 2009 to Insulate a Million Ceilings in a Year, Using Installers Who Signed Up Online. Its First Industry Meeting Heard New Zealand Had Tried This and Three People Electrocuted Themselves.

Subway Told Australian Customers Its Footlong Was a Trademark Name, Not a Measurement of Length. The US Trademark Board Ruled It Was a Measurement of Length and Refused Subway the Trademark.