A Cyberattack Bricked Thousands of Breathalyzers. Drivers Couldn’t Start Their Cars.

On a Thursday morning in March, thousands of Americans walked to their cars, blew into their court-mandated ignition interlock devices, and got nothing. No green light. No engine turnover. Just a frozen screen and a vehicle that refused to start.

The cause wasn’t a mechanical failure. It was a cyberattack.

TechCrunch reported that Dräger, one of the largest manufacturers of vehicle-mounted breathalyzer interlock systems in the United States, suffered a significant cybersecurity breach that rendered its devices inoperable across multiple states. The attack targeted backend infrastructure that communicates with the interlock devices installed in vehicles — the same devices that tens of thousands of people depend on daily to legally drive to work, medical appointments, and court-ordered programs.

The fallout was immediate and chaotic.

Drivers found themselves stranded in driveways, parking lots, and gas stations. Many had no alternative transportation. Some missed shifts at work. Others couldn’t pick up children from school. A device designed to enforce accountability for past DUI offenses had become, overnight, a tool of involuntary immobilization — not because of anything the drivers did, but because a company’s servers were compromised.

Ignition interlock devices are a cornerstone of DUI enforcement policy in all 50 states. After a drunk driving conviction, courts frequently require offenders to install these breathalyzer units in their vehicles for periods ranging from six months to several years. The driver must blow into the device and register a blood alcohol concentration below a set threshold — typically 0.02% — before the engine will start. Rolling retests are required during drives. The devices log every test result and transmit data to monitoring authorities, probation officers, and state DMVs.

It’s a system that depends entirely on connectivity and software integrity. And that’s precisely what broke.

According to the TechCrunch account, the attack appears to have disrupted the cloud-based servers that Dräger’s interlock devices rely on for calibration updates, compliance reporting, and activation commands. When those servers went dark, the devices defaulted to a lockout state — the fail-safe behavior programmed into the hardware. In security terms, the devices “failed closed,” meaning they treated the loss of communication as a potential tampering event and shut down accordingly.

That design choice is defensible from a public safety standpoint. You don’t want an interlock device that simply lets someone drive when it can’t verify sobriety. But the consequence of that architecture is stark: a single point of failure in the cloud infrastructure can ground every vehicle connected to it, simultaneously, with no manual override available to the driver.

Dräger, a German medical and safety technology company with operations across the globe, confirmed the incident but provided limited details in its initial public statements. The company said it was working with cybersecurity experts and law enforcement to investigate the breach and restore service. It did not disclose whether customer data — including personal identification, court records, or BAC test histories — had been accessed or exfiltrated.

That question matters enormously. Interlock device databases contain some of the most sensitive personal information imaginable: names, addresses, driver’s license numbers, court case details, and a granular record of every breath test a person has taken for months or years. A breach of that data wouldn’t just be a privacy violation. It could expose individuals to blackmail, employment discrimination, or social stigma.

The cybersecurity community took notice quickly. Researchers on X began dissecting the implications within hours of the first reports. Several noted that interlock device manufacturers have historically operated with minimal public scrutiny of their digital security practices, despite handling data that intersects with both criminal justice and personal health records. The devices sit at an unusual crossroads — they’re consumer-facing hardware mandated by government authority, maintained by private companies, and connected to cloud services that most users never think about.

And most users have no choice in the matter. Courts typically specify which interlock provider a convicted driver must use, or limit options to a short list of approved vendors. Drivers can’t shop around for the company with the best cybersecurity posture. They take what they’re assigned and hope it works.

This dynamic creates a troubling accountability gap. When a government mandate forces citizens to depend on a private company’s technology, and that technology fails due to inadequate security, who bears responsibility? The driver, who missed work and may now face a probation violation for not completing a required check-in? The company, which collected fees — often $70 to $150 per month from each user — while apparently failing to protect its infrastructure? Or the state, which mandated the use of a system it didn’t audit?

So far, no state attorney general has issued a public statement on the Dräger breach. But legal experts say the incident could trigger investigations under state data breach notification laws, particularly if personal information was compromised. Several states, including California, Illinois, and Texas, have aggressive data protection statutes that impose significant penalties for failures to safeguard consumer data and for delays in breach notification.

The timing is especially uncomfortable for the interlock industry. Federal legislation has been moving steadily toward requiring alcohol detection technology in all new vehicles, not just those driven by convicted offenders. The Infrastructure Investment and Jobs Act, signed into law in 2021, directed the National Highway Traffic Safety Administration to develop a federal motor vehicle safety standard requiring “advanced drunk and impaired driving prevention technology” in all new passenger vehicles. NHTSA has been studying both breath-based and touch-based sensor systems for potential nationwide deployment.

A high-profile cyberattack that bricks existing interlock devices doesn’t exactly inspire confidence in scaling that technology to every car on the road.

Industry observers have drawn comparisons to other attacks on operational technology — the class of systems that control physical processes in the real world. The Colonial Pipeline ransomware attack in 2021 disrupted fuel supplies across the eastern United States. Attacks on water treatment facilities have attempted to alter chemical dosing levels. The Dräger incident is smaller in scale but conceptually similar: a cyberattack on a digital system produced an immediate, tangible effect on people’s physical ability to move through their daily lives.

The interlock industry in the U.S. is dominated by a handful of companies. Dräger competes with Intoxalock (a subsidiary of Consumer Safety Technology), Smart Start, and LifeSafer, among others. Together, these firms service an estimated 350,000 or more active interlock installations nationwide at any given time, according to data compiled by the advocacy group Mothers Against Drunk Driving. The market generates hundreds of millions of dollars in annual revenue, almost entirely paid out of pocket by the drivers themselves.

That revenue model creates its own perverse incentives. Drivers are captive customers. They pay monthly fees, calibration fees, installation fees, and removal fees. They pay for violations they may not have caused — a mouthwash rinse that triggers a false positive, a device malfunction logged as a “missed test.” Adding cybersecurity failures to that list of indignities is unlikely to sit well with either the affected individuals or the courts that oversee their compliance.

Defense attorneys have already begun raising the incident in court proceedings. In at least two states, lawyers representing interlock-equipped drivers have filed motions arguing that their clients should not face sanctions for compliance gaps that occurred during the outage period. The legal theory is straightforward: a driver who was willing and able to comply with a court order but was prevented from doing so by a third-party technology failure should not be punished for that failure.

Whether judges agree will vary by jurisdiction. But the motions themselves signal a new category of legal challenge that interlock companies and courts will need to address going forward.

From a technical standpoint, the Dräger incident raises questions that the company has so far declined to answer in detail. Was the attack ransomware? A supply chain compromise? An exploitation of a known vulnerability in cloud infrastructure? Did the company have adequate intrusion detection and incident response capabilities in place? Were backups sufficient to restore service, and how long did full restoration take?

TechCrunch reported that some devices remained inoperable for more than 48 hours after the initial attack. For drivers who depend on their vehicles to earn a living, two days without transportation isn’t an inconvenience. It’s a crisis.

The broader cybersecurity implications extend beyond interlock devices. The connected vehicle industry is growing rapidly, with automakers, insurers, and fleet operators all building services that depend on persistent connectivity between cars and cloud platforms. Every one of those connections is a potential attack surface. If a breathalyzer company’s servers can be knocked offline and strand thousands of drivers, what happens when the target is a fleet management system, a remote vehicle disabling service used by lenders, or an over-the-air update mechanism for autonomous driving software?

These aren’t hypothetical concerns. Researchers have demonstrated remote exploits against connected vehicle systems for years. In 2015, Charlie Miller and Chris Valasek famously took remote control of a Jeep Cherokee through its Uconnect infotainment system, prompting a recall of 1.4 million vehicles. The attack surface has only expanded since then.

What makes the Dräger case distinctive is the population it affected. These aren’t early adopters who chose to connect their vehicles to the internet. They’re people under court supervision, often from lower-income backgrounds, who were compelled to install a connected device in their vehicles and had no say in its security architecture. The power asymmetry is striking.

Consumer advocates have called for mandatory cybersecurity standards for interlock devices, analogous to the requirements imposed on medical devices by the FDA. The comparison isn’t perfect — interlock devices aren’t implanted in human bodies — but the principle is similar. When a technology is mandated by law and directly affects a person’s liberty and livelihood, the security of that technology should meet a correspondingly high bar.

No such standard currently exists. The interlock industry is regulated primarily at the state level, with requirements focused on device accuracy, calibration schedules, and data reporting. Cybersecurity is rarely mentioned in state interlock regulations. The National Highway Traffic Safety Administration sets model specifications for interlock devices but does not mandate specific cybersecurity controls.

That gap is now impossible to ignore.

Dräger has said it will provide affected customers with documentation of the outage to present to courts and probation officers. The company has also waived certain fees for the affected period, though it hasn’t specified which ones or for how long. Whether those gestures will be sufficient to address the harm caused — lost wages, missed appointments, potential legal consequences — remains to be seen.

Class action attorneys are watching. At least one firm has publicly announced an investigation into potential claims against Dräger on behalf of affected drivers. The legal theories could range from breach of contract and negligence to violations of state consumer protection statutes and data breach notification laws.

But litigation, even if successful, is a backward-looking remedy. The more pressing question is what changes — in regulation, in technology design, in contractual obligations — will prevent this from happening again. Because the interlock industry isn’t shrinking. It’s growing. And the next generation of vehicle safety technology, if NHTSA’s rulemaking proceeds as expected, will connect alcohol detection systems to the ignition systems of every new car sold in America.

The stakes, in other words, are about to get much higher. A cyberattack that strands a few thousand interlock users is a serious incident. A cyberattack that could theoretically disable millions of vehicles equipped with mandated alcohol detection technology is something else entirely.

For now, the drivers affected by the Dräger breach are left to sort out the consequences on their own — explaining to employers why they didn’t show up, petitioning courts for leniency, and waiting for a company they didn’t choose to fix a problem they didn’t cause. It’s a vivid illustration of what happens when critical infrastructure is entrusted to private companies without adequate oversight of the digital systems that make it all work.

And it won’t be the last time.