In September 2005, Canada’s federal transport ministry pointed to a grim statistic — stolen-vehicle crashes were killing an average of 27 people a year, with youth offenders behind an outsized share of them — and did something the United States still hasn’t done two decades later: it made engine immobilizers mandatory on every new car sold in the country, effective for the 2007 model year. Transport Canada’s own announcement made the logic plain: roughly 80 percent of new Canadian vehicles already had the technology, and those models were already showing lower theft rates. Making it universal closed an obvious gap. It didn’t require inventing anything.
Two decades later, a father in Glendale, Arizona did what federal regulators never required Hyundai and Kia to do for him: he closed the gap himself. According to Glendale police, two boys — ages 12 and 13 — are accused of stealing at least eight Kias and Hyundais near 67th Avenue and Maryland between July and August, working the exposed ignition column with a stripped wire and a USB cable shaped to fit, according to a Phoenix-area mechanic who examined the method. Officers said the tip that cracked the case open didn’t come from a drone or a license-plate reader. It came from one of the boys’ own fathers.
That’s a good local crime story. It isn’t, on its own, a car story. The car story is why two middle-schoolers could do this at all, and that story is older, bigger, and considerably less flattering to two automakers who have known about it for the better part of a decade.
The vulnerability was a spreadsheet decision, not a design flaw
An electronic immobilizer — a chip in the key that has to talk to the car’s computer before the engine will start — isn’t exotic engineering. By 2015, it was standard equipment on 96 percent of new vehicles sold in the United States, according to Highway Loss Data Institute research. On Hyundai and Kia models built that same year, it was standard on just 26 percent. The companies weren’t behind on the technology. They had simply decided, trim by trim, that a steel key and a turn-to-start ignition were good enough for the affordable end of the lineup — the Accent, the Rio, the Soul, the Elantra, the Sportage, the Forte.
That decision was legal. The federal government has never required immobilizers. The Vehicle Theft Prevention Standard that NHTSA administers lets an automaker skip the requirement to inscribe VIN numbers on major parts if it equips a vehicle line with an immobilizer proven just as effective — but the agency has been explicit that installing one is not a prerequisite for that exemption. It’s a carrot with no stick, which made it a rounding error against the cost of wiring a chip and an antenna ring into millions of base-trim cars. Canada closed that exact loophole in 2007. The U.S. still hasn’t.
Social media didn’t create the vulnerability. It just mapped it for everyone
For most of the 2010s, the gap sat there mostly unexploited, because popping a steering column with a screwdriver was still the default method and it wasn’t shared at scale. That changed once videos began circulating showing how little a Hyundai or Kia without an immobilizer actually demanded of a thief. Arizona has already seen organized versions of this exact crime; Glendale’s case looks more like two kids who watched the same videos as everyone else.
The numbers moved fast once the method went viral. NHTSA has tied the trend to at least 14 crashes and eight deaths nationally. By the second half of 2023, theft-claim frequency for Hyundai and Kia vehicles ran more than 11 times higher than in early 2020 — and eight times higher than every other manufacturer combined over that same stretch, per HLDI. The Elantra alone has spent much of the past two years near the top of America’s most-stolen list, not because it’s a popular target in the usual sense, but because for a long stretch of production, it was one of the easiest cars in a parking lot to start without a key.
The fix arrived late, and it’s still not finished
Hyundai and Kia began rolling out a free anti-theft software update in February 2023 that extends the alarm duration and requires a key in the ignition to start the car, covering roughly 3.8 million Hyundais and 4.5 million Kias. Hyundai notes that every vehicle it has built since November 2021 already ships with a standard immobilizer — which is its own quiet admission that the company knew how to solve this well before the recall campaign forced the issue. Kia has since added a hardware option, an ignition cylinder protector, for older models that can’t run the software fix at all.
Here’s the part that doesn’t make it into the press releases: adoption has crawled. HLDI found that by December 2023, only about 30 percent of eligible Hyundais and 28 percent of eligible Kias had actually received the update; by mid-2024 that had climbed to roughly 60 percent, which still leaves millions of unpatched vehicles parked in driveways exactly like the ones in Glendale. California’s attorney general went further in a 2025 settlement, alleging the software fix itself “could be — and in fact was — easily bypassed by thieves.” New York’s attorney general, settling a separate case in December 2025, found that the hardware option for vehicles ineligible for the software patch had reached only about 20 percent of them. The fix for the fix is itself incomplete.
Where the software update has actually been installed, it works — HLDI measured a 53 percent drop in theft claims and a 64 percent drop in whole-vehicle theft on updated cars. That’s a real result. It’s also proof the remaining exposure is a distribution problem now, not a technology problem: the fix exists, it’s free, and it still depends on an owner noticing a mailed notice and driving to a dealership.
What this actually costs, and who’s paying it
None of this stays contained to stolen cars. Insurers have adjusted premiums and, in some documented cases, declined to renew policies on high-theft Hyundai and Kia models, pushing the cost of the immobilizer gap onto owners who never asked for a base-trim ignition. The multistate settlements have now put a real number on the manufacturers’ side of the ledger too — restitution funds, state penalties, and reporting requirements that will keep regulators watching this for years. The age of the offenders keeps trending younger, which tracks with how little skill the exploit actually requires. This was never a sophisticated crime. That’s exactly the problem.
The immobilizer that would have stopped Glendale’s case was never a technical mystery. Canada mandated it in 2005 after looking at kids dying in stolen cars and deciding that was reason enough. The United States looked at the same technology, left it optional, and is still cleaning up the difference two decades later — one dealership software update, one father’s phone call, at a time.
If your Hyundai or Kia was built before the 2022 model year, it’s worth a call to the dealer to check eligibility for the free update — not because a window decal will stop a determined thief, but because right now, for millions of cars, there’s still nothing stopping an undetermined one. Should automakers be required to backfit safety technology like this at their own expense once a defect pattern is this well-documented, or is a voluntary recall program enough?