Short: VIN2VICTIM: From Vehicle Identification to Targeted Tracking via Data Broker Exploitation

Connected vehicles relay GPS telemetry to manufacturers, who routinely sell it to data brokers.We present VIN2VICTIM, an attack pipeline that converts a single Vehicle Identification Number into targeted physical tracking through four composable stages: owner deanonymization, trajectory reidentification, home and workplace inference, and departure prediction. Three structural properties make vehicles qualitatively worse than phones for privacy. VINs are immutable lifelong correlators, consent is coarse and vehicle-scoped, and VINs bridge the digital-to-physical gap. We evaluate the pipeline on three public GPS datasets (T-Drive, 18 taxis; GeoLife, 11 users; Porto, 50 taxis) spanning 2008 to 2014 and test its resilience to broker-grade temporal coarsening. Two spatio-temporal points re-identify 96 to 99% of taxi traces and 82% of personal GPS traces (N=11 to 50). Home clusters are produced for 92 to 100% of users; for the 11 GeoLife users with multi-modal traces, 10 of 11 clusters fall inside an OpenStreetMap residential polygon. The attack survives 60-minute sampling intervals despite 91% data reduction, and geo-indistinguishability at ε=0.1 still preserves 74 to 78% unicity.