Tesla paid $15,000 per bug to a hacker who later says he recovered crash data from the company’s systems, according to a report

Tesla is again at the center of a debate over vehicle data and cybersecurity after a Yahoo Finance report said the automaker paid a Russian hacker $15,000 for each software issue he helped uncover, through an initiative described as a bug bounty program. Bug bounties are structured payouts offered by companies to external security researchers who find vulnerabilities and report them responsibly.

According to the report, the hacker later “cracked open the case” and recovered crash-related data he said Tesla had sworn did not exist. The article describes the shift from the initial disclosure work to a later recovery effort, presenting it as a sequence that ultimately increased Tesla’s exposure and costs, though the precise mechanism and evidence are not detailed in the available excerpt.

The report also cites a figure of $243 million as the cost tied to the later episode. However, the excerpt provided does not explain whether that amount reflects a legal settlement, an operational expense, penalties, or damages, nor does it identify the jurisdiction, case name, or timeframe. It similarly does not provide direct quotes from Tesla or the researcher, beyond the narrative framing.

What is clear from the reported account is that Tesla’s security testing approach included paying for discovered bugs, and that the same researcher is connected to both the original flaw-finding work and a later claim of accessing crash data. The article’s description indicates that the bug bounty effort was aimed at identifying “software flaws,” but it does not list the affected components, software versions, or the number of bugs or payouts involved.

In autos, data accessibility and integrity can become as important as safety itself. Regulators, plaintiffs, and researchers often focus on what event data is available after an incident, what safeguards are in place, and how internal systems store or protect sensitive telemetry. At the same time, automakers have strong incentives to find vulnerabilities early, because connected vehicles and over-the-air software updates expand the attack surface.

Tesla and other automakers generally treat vulnerability research as a way to reduce risk. Bug bounties, in particular, are used to draw on outside expertise rather than relying exclusively on internal teams. The report suggests the payments and the later data recovery claim are linked by the same individual, raising questions about how researchers verify findings and how companies validate the boundaries of what their systems can store.

The key missing pieces from the available information are documentary: the excerpt does not include Tesla’s statements on the bug bounty program’s outcomes, a confirmation of the researcher’s identity, or the evidentiary basis for the “crash data didn’t exist” claim. It also does not specify what “recovered” means in practice, whether the data was obtained from logs, telemetry streams, crash analysis tools, or another source.