The scandal known as the Tesla Files began with a 100-gigabyte cache of internal data passed to the German newspaper Handelsblatt by a former Tesla service technician named Łukasz Krupski. The documents described how the company handled customer complaints, what its engineers knew about Autopilot crashes, and how it stored the personal information of customers, employees and trade partners. Authenticity was confirmed by the Fraunhofer Institute for Secure Information Technology.
The leak covered two of Tesla's European IT operations (Germany and the Netherlands) and dwarfed almost anything that had previously come out of a major automaker. Reporters counted more than 23,000 documents, customer complaints from three continents, and personal records on roughly 75,000 current and former employees, including Elon Musk's own social security number.
Elon Musk at the 2015 Tesla Motors Annual Meeting
©Steve
Jurvetson (CC
BY 2.0)
The whistleblower has a name
Krupski worked at Tesla's service centre in Drammen, Norway, preparing new vehicles for handover to Norwegian customers. His turn from technician to whistleblower began in March 2019, when he pulled a modified third-party charger from beneath a Model 3 that had caught fire outside a customer's home, stopping what could have become a serious blaze. Musk emailed him personally with "Congratulations for saving the day," and Krupski used the reply to raise broader safety concerns. The relationship with his managers deteriorated soon after.
In 2021 he filed a whistleblower complaint with the U.S. Securities and Exchange Commission, alleging that Tesla had violated securities law and deviated from accounting standards. The SEC closed the file without a full review. Tesla terminated him in 2022, citing time management and unauthorised photography. By the autumn of that year, Krupski had concluded that the regulators were not going to act on what he had seen, and he picked up the phone to a German newsroom.
In November 2022, two Handelsblatt journalists, Sönke Iwersen and Michael Verfürden, took a meeting with an anonymous source. Six months of cross-checking and customer interviews later, they had a story. When the paper published in May 2023, Krupski was no longer just a voice on a transcript. Like other tech-industry insiders before him, he had decided that putting a name to the disclosures was the only way to keep them from being buried.
Verbal communication only
The files revealed how Tesla handled complaints and communicated with customers. Staff followed precise guidelines aimed at minimising legal exposure. Reports were marked "for internal use only", and information was to be shared verbally rather than in writing. The instructions explicitly told employees not to copy reports into emails, text messages or voicemails. Customers reported that Tesla staff primarily relied on verbal communication and avoided written exchanges.
Before sharing any of this with the public, Handelsblatt ran the documents past dozens of customers in different countries, and each one corroborated the picture in the files. The incidents covered ran from 2015 to 2022, mainly in the United States but also in Europe and Asia. One was a 2021 California crash in which the car accelerated on its own and slammed into concrete pillars; others ended in walls, other vehicles or a ditch. Customer complaints touched on collision warnings, Autopilot behaviour, driver assistance, acceleration and braking, including phantom and emergency braking, that staff had been told to keep off the record.
The data paints the picture of an electric car pioneer who seems to have far greater technological problems than previously known.
Sebastian Matthes, editor-in-chief of Handelsblatt
Data protection violation
Sharing the cache with Handelsblatt also put Tesla on the wrong side of the European Union's General Data Protection Regulation (GDPR). The files were considered inadequately protected: plenty of personal information about customers, employees and partners could have been pulled out by anyone with internal access. Inside the trove sat private contact details, customers' bank details, salaries and names of former and current Tesla workers, alongside what reporters described as more than 23,000 internal documents. A parallel Reuters investigation in 2023 added another layer: between 2019 and 2022, groups of Tesla employees had circulated invasive videos and photos taken by the built-in cameras of customers' cars, treating private footage (including a clip of a naked man walking to his vehicle) as in-house memes.
I can't remember such a scale
Dagmar Hartge, Brandenburg data protection officer
Brandenburg's data protection officer notified the German authorities in April 2023, then handed the file to the Dutch DPA as the lead European supervisor of Tesla's processing. The headline 3.5 billion-dollar fine extrapolated by 2023 coverage from GDPR's 4-percent revenue ceiling has not materialised. What did materialise was a U.S. class action: Pai v. Tesla, filed in September 2023 over the exposure of personal data on roughly 75,000 employees. In January 2025, Judge James Donato of the Northern District of California sent the case into private arbitration, finding that Tesla's employment contracts had incorporated JAMS arbitration rules.
Tesla strikes back at the source
Tesla's first move against the leak was to call it a theft. Within days of Handelsblatt's first piece, Norwegian police searched Krupski's home at Tesla's request, seizing his computer, phone and storage devices. The company also obtained an interim injunction barring him from talking to public authorities or the media. Publicly, Tesla labelled him a "former service technician" and a "disgruntled former employee" and announced legal consequences for both Handelsblatt and the source. As with Frank Serpico a generation earlier, the disclosure had to travel through journalism because the internal channels had not delivered.
That posture did not hold up in court. On 12 July 2024, the Buskerud District Court overturned the injunction and declared Krupski a legitimate whistleblower under Norwegian employment law and Article 10 of the European Convention on Human Rights. The same court returned to the matter in December 2024 and ordered Tesla to pay him more than 10,000 euros in damages plus around 170,000 euros in legal costs. That fell short of the 250,000 euros he had sought, but the ruling leaves the company, not the leaker, paying the lawyers.
On the cabin-camera question, Tesla's official line remained that its system "is designed from the ground up to protect your privacy." The Tesla Files made that line harder to repeat without irony.
Autopilot under federal scrutiny
While European regulators worked through the data-protection layer, U.S. agencies focused on what the files said about the cars themselves. In December 2023, NHTSA closed a long-running investigation into Autopilot misuse with Recall 23V838, covering roughly 2 million Tesla vehicles in the United States. The over-the-air fix was meant to add prominent visual alerts, escalate driver-engagement checks, and disable Autopilot for a week if drivers ignored repeated warnings.
Five months later, NHTSA reopened the question. In April 2024 the agency announced a follow-up probe asking whether the recall fix had really addressed the underlying problem, after counting at least 20 further crashes with Autopilot active since the patch. In October 2024 it opened a second investigation, this one covering about 2.4 million vehicles, into Tesla's Full Self-Driving option. The trigger was four collisions in low-visibility conditions, including a fatal pedestrian strike. NHTSA framed the new probe as new territory: the question was no longer whether drivers were paying enough attention, but whether FSD itself could detect hazards on the road.
The U.S. Department of Justice has been working a parallel track. In an October 2023 SEC filing, Tesla disclosed that prosecutors had issued subpoenas covering Autopilot, Full Self-Driving, vehicle range, related-party benefits and personnel decisions. By May 2024, Reuters was reporting that the probe had narrowed in on possible securities and wire fraud, examining whether Tesla and Musk had misled investors and consumers about the cars' self-driving capability.
A jury finds Autopilot defective
That scrutiny reached a courtroom on 1 August 2025. A federal jury in Miami delivered a verdict in Benavides v. Tesla, the first U.S. case to put Autopilot's design directly to a jury. The crash had happened in April 2019 on Card Sound Road in Key Largo: George McGee's Model S, with Enhanced Autopilot engaged, ran a stop sign at 62 miles per hour and struck Naibel Benavides Leon, 22, and her boyfriend Dillon Angulo, who was severely injured. Benavides died at the scene.
The jury awarded 243 million dollars (43 million in compensatory damages and 200 million in punitive damages) and apportioned 33 percent of the fault to Tesla, 67 percent to the driver. In a February 20, 2026 ruling, Judge Beth Bloom of the Southern District of Florida denied Tesla's motion to toss the verdict, writing that the evidence at trial more than supported the jury's conclusion. For a company whose stock-market story had treated self-driving software as a multi-trillion-dollar growth lane, a finding that the system was itself defective matches what the leaked documents had been describing since 2015.
From confidential leak to public record
The Tesla Files have since outgrown the original Handelsblatt series. Krupski received the 2023 European Whistleblowing Prize from Blueprint for Free Speech. Iwersen and Verfürden then turned the reporting into a book, The Tesla Files: A Whistleblower, a Leak, a Fight for Truth, drawing on the 100-gigabyte cache, the 23,000 documents and hundreds of interviews. It joins a longer line of whistleblower-driven publishing about powerful companies whose internal records contradicted their public line.
November 2021, when Tesla was worth 1.2 trillion dollars, was the high-water mark; by the spring of 2023, when Krupski's leak broke, the figure was less than half. The valuation has since recovered to the trillion-dollar tier, but the regulatory and legal layer the leak set in motion has not retreated. Investigations that were mere possibilities at the moment of publication are now docketed cases, agency probes and a finalised verdict.
The documents did the opposite of what the policy required. A directive that customer complaints be carried in person and never written down survived only as long as the documents themselves stayed inside the building.
