Kia Boys
Data Viz
In 2011, Kia made a decision that would cost the company hundreds of millions of dollars and several American cities a decade of stolen cars. It shipped base-model vehicles to the US without an engine immobilizer.
An immobilizer is a cheap chip that refuses to start the car unless the real key is present. By 2000 it was already standard on 62% of other manufacturers' vehicles. It costs about $100 to build in. Kia and Hyundai put them in cars sold in Canada and Europe, just not in America, because no American law required one. The companies held that line for a decade: only 17% of their 2011 models had one, and even by 2015 it was just 26%, against 96% for everyone else.
So for ten years, millions of Kias and Hyundais rolled off the line with an ignition that was, mechanically, a screw waiting for a handle.
How it started
Milwaukee, fall 2020. The first thieves weren't following a trend. They figured out, apparently on their own, that you could pop the plastic off the steering column, break the ignition switch, and turn the exposed nub with anything that fits. A USB-A plug fits. The word spread the old way, mouth to mouth, one city at a time.
The numbers move before any video does. Milwaukee Police counted Hyundai thefts going 23, then 56, then 99 per month between September and November 2020. Kias went 16, 21, then 110. By April 2021, 71% of stolen vehicles in the city were Kias or Hyundais, up from 6% two years earlier. Full-year 2021: 10,476 cars stolen, two-thirds of them Korean brands, the largest jump of any city in the country.
The skill had saturated one midwestern city for twenty months before it had a hashtag.
How it exploded
Then came distribution. In May 2022, a YouTuber named Tommy G uploaded sixteen minutes riding along with self-styled "Kia Boys" in Milwaukee, including footage of the steering-column break. Two months later, on July 12, 2022, a TikTok user named @robbierayyy posted a short USB-cable demonstration. That video, plus clips cut from the documentary, became a franchise kit. Anyone, anywhere, could now learn in thirty seconds what Milwaukee teens had worked out through trial and error.
What followed reads like a typo in most headlines:
- Portland, OR: Kia thefts up 916% year over year.
- Chicago, IL: Korean-brand share of car thefts went from 8% to 48% in six months.
- Columbus, OH: Attempted thefts up 21,400% in a single year.
- Nationwide, one economics study estimates about 64,000 excess thefts in 15 months.
By 2024, the Hyundai Elantra was the single most stolen car in America. A Sonata and a Kia Optima sat behind it in second and third.
The absurdity compounds at the human level. Most of the people arrested were children; Milwaukee police arrested kids under 16 for auto theft 554 times in 2021. A 14-year-old driving a stolen Kia into a school bus left a 15-year-old friend in a coma. Four teens died in Buffalo in October 2022 when a stolen Kia crashed at 6:30 in the morning, the event that pushed the story onto every network. Teenagers filmed their crimes because the views were the point. In jail, one bragged on a recorded call: "I heard my video went viral too."
Kia vehicles reported stolen in Portland, OR
Monthly totals, Jan 2021 to Dec 2023. Time runs top to bottom; further right means more cars stolen.
Feb 2021
News outlets in Milwaukee, WI report a spike in Kia thefts.
Aug 2021
The first "Kia Boyz" video appears online.
May 2022
A documentary on the "Kia Boyz" is posted to YouTube.
Jul 2022
A TikTok showing how to start a Kia with a USB plug goes viral.
Oct 2022
Kia dealerships begin distributing free wheel locks.
Feb 2023
The first round of software patches is released.
Jun 2023
The last of the vehicle software patches is released.
Nov 2023
Congress sends a letter demanding the automakers' CEO act.
Jan 2024
A coalition of major U.S. cities petitions NHTSA for a national recall.
May 2024
Officially named the most stolen manufacturer in the U.S.
View the data as a table
| Month | Vehicles stolen |
|---|---|
| Jan 2021 | 8 |
| Feb 2021 | 2 |
| Mar 2021 | 6 |
| Apr 2021 | 5 |
| May 2021 | 4 |
| Jun 2021 | 4 |
| Jul 2021 | 4 |
| Aug 2021 | 5 |
| Sep 2021 | 3 |
| Oct 2021 | 10 |
| Nov 2021 | 3 |
| Dec 2021 | 3 |
| Jan 2022 | 8 |
| Feb 2022 | 5 |
| Mar 2022 | 12 |
| Apr 2022 | 10 |
| May 2022 | 11 |
| Jun 2022 | 17 |
| Jul 2022 | 39 |
| Aug 2022 | 121 |
| Sep 2022 | 80 |
| Oct 2022 | 93 |
| Nov 2022 | 150 |
| Dec 2022 | 194 |
| Jan 2023 | 197 |
| Feb 2023 | 159 |
| Mar 2023 | 129 |
| Apr 2023 | 91 |
| May 2023 | 82 |
| Jun 2023 | 106 |
| Jul 2023 | 87 |
| Aug 2023 | 80 |
| Sep 2023 | 99 |
| Oct 2023 | 66 |
| Nov 2023 | 55 |
| Dec 2023 | 106 |
| Jan 2024 | 68 |
| Feb 2024 | 59 |
| Mar 2024 | 65 |
| Apr 2024 | 76 |
| May 2024 | 62 |
| Jun 2024 | 43 |
| Jul 2024 | 52 |
| Aug 2024 | 29 |
| Sep 2024 | 23 |
| Oct 2024 | 47 |
| Nov 2024 | 69 |
| Dec 2024 | 43 |
Why Kia let it happen
It is worth being clear about the causal chain, because both companies spent years insisting federal standards were met. That was true and irrelevant. No US rule requires an immobilizer. The choice was theirs, made in the same building that chose to sell immobilizer-equipped cars in Canada and Europe at the same time.
The paper trail makes it hard to call it an oversight. In 2017, NHTSA granted Kia's own technical center a theft-standard exemption for the Kia Niro precisely because that model shipped with an immobilizer, while other Kia lines kept shipping without one. The omission was a line-by-line business decision, priced at roughly $100 per car, made for the cheapest trims in the market with no legal requirement to do better. When Milwaukee police first called in May 2021, the companies answered that they met national standards. Which was true. And which was the whole problem.
Only in late 2021, as the theft data piled up, did both makes finally make immobilizers standard.
The lawsuits
Here is the part that confuses everyone, and the confusion is understandable: there wasn't one case. There were four different wars fought by four different kinds of plaintiffs, and they moved at different speeds.
1. The consumers. Owners sued, claiming the cars were defective, and the cases were rolled into one giant federal case in California. It settled in May 2023 for about $200 million, covering roughly 9 million vehicles: cash back for theft losses, deductibles, and a free anti-theft software fix. The judge rejected the first draft and made them try again, appeals dragged on, and as of late summer 2026 the approved claimants still haven't been paid.
2. The cities. Milwaukee, Chicago, New York, Baltimore and other cities sued, arguing the theft wave cost them real money in police and emergency response. These cases are still open, years later. They're also where the companies finally have to answer, under oath, why the immobilizers were left out. Those answers are sealed.
3. The insurers. Insurance companies paid for tens of thousands of stolen cars, then sued the automakers to get the money back. Their first trial fell apart before a jury was even seated; the retrial is set for September 2026. If the insurers win, it's the lawsuit with the most financial teeth, because they hold the receipts for the whole wave.
4. The states. State attorneys general took a different route, consumer protection law instead of a court verdict. In December 2025, a bipartisan coalition of about 35 states struck a deal: free ignition-cylinder protectors for every remaining vulnerable car, restitution for people whose fixed cars were stolen anyway, and a binding promise that all future US-sold vehicles get an immobilizer. This is why affected owners are getting notices through 2026 and 2027.
One more thread runs through all of it: the federal regulator stayed out. Petitioned by 18 state attorneys general to recall the vehicles, NHTSA replied that immobilizers are not required by federal law and that its theft test "does not contemplate actions taken by criminal actors to break open or remove part of the steering column." To this day there has never been a formal federal recall of these cars. Every remedy that exists came from lawsuits, not from the agency whose job is safety.
How it ended, mostly
The fix, when it finally came, worked. Starting in February 2023, a free software update for about 8.3 million vehicles made the alarm trigger an ignition kill unless the car was locked with the fob. Independent insurance data later showed upgraded cars had 53% lower theft-claim frequency than their unupgraded twins. The catch was speed: fewer than a third of eligible owners had installed it a year and a half in, so the wave kept rolling well after the fix existed.
The numbers eventually came down. US vehicle thefts fell 16.6% in 2024, with Kia and Hyundai thefts down about 37%. Milwaukee dropped to half its peak. But the tail is long: teens were still crashing stolen Kias into other cars in 2026, and police in Wisconsin were still warning about the "TikTok challenge" that January.
The arithmetic of the whole affair is bleak in a way that deserves its own sentence. A $100 part, skipped across roughly nine million vehicles, produced an estimated 64,000 excess thefts, at least 14 deaths tied to the challenge, more than $1 billion in insurance losses, a $145 million settlement still unpaid five years later, and a half-billion-dollar hardware retrofit program. The companies saved the cost of the chip. Everyone else has been paying for it since.
