That's what Casey Halverson, a "self-described free-lance security blogger" told the New York Times, saying that the way that Carwings handles RSS feeds leaves the car's information open to RSS providers the car is subscribed to, and that Nissan "pretty much left it wide open."
This might be a case of crying wolf though, as the Times notes that actually tracking a Leaf would be difficult. Nissan spokeswoman Katherine Zachary told the New York Times that yes, indeed, the data is thouroughly protected:
We've asked Zachary to clarify the timing of events here, and she told AutoblogGreen, "the change was made right away through the Global Data Center. This is no longer an issue." So, Leaf drivers, there's no need to worry any more.
Nissan takes consumer concerns very seriously and has responded quickly to stop the transmission of a vehicle owner's privacy-related data for nonofficial RSS sites. The data involved does not and cannot be attributed to any specific vehicle or owner.
[Source: NY Times]