IANAL but this is in their user agreement [0]: 1.9 Unauthorized use, tampering and hacking. You must not tamper with, attempt to gain unauthorized access to,

IANAL but this is in their user agreement [0]: 1.9 Unauthorized use, tampering and hacking. You must not tamper with, attempt to gain unauthorized access to, modify, hack, repair, any Voi material or hardware, source-codes, information, including the Voi App, Website and Scooter, for any purposes. The Voi App, Website and the Scooter may only be used for the purposes pursuant to this Agreement. If that's valid in court, that's another matter. It looks like the Sweden Penal Code has a definition of data breach and jail time [1] 0 - https://www.voiscooters.com/voi-user-agreement-12rr/ https://www.voiscooters.com/voi-user-agreement-12rr/ 1 - https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/sweden https://iclg.com/practice-areas/cybersecurity-laws-and-regul... EDIT: Not discussing the technical details of this post because they are quite boring, to be honest. That's Web Security 101 and, given so many previous incidents, far from surprising that these companies aren't handling it well.