The hack also potentially exposed the electric car company's data.
Researchers for RedLock found that Tesla's credentials on an IT administrative console were not password protected. They made the discovery while trying to track down which organizations had left their Amazon Web Services (AWS) credentials openly exposed on the internet last month.
The hackers quietly hijacked the console and began running scripts to generate virtual currency like bitcoin, the latest in a series of "cryptojacking" attacks. The researchers also found the hackers used "sophisticated evasion measures" to go undetected.
A spokesperson for Tesla said the company learned about the breach in a company-sanctioned bug bounty program that pays outside hackers to discover vulnerabilities or exploited systems within the company.
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," the spokesperson said in a statement.
"The impact seems to be limited to internally used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way."
Fortune first reported the Tesla breach.
"We weren't the first to get to it. Clearly, someone else had launched instances that were already mining cryptocurrency in this particular Tesla environment," Varun Badhwar, CEO and cofounder of RedLock, told the magazine.
Vehicle data from Tesla could have been exposed to the hackers through the Amazon "simple storage service" bucket, the researchers found.
Badhwar echoed the company's statement, telling Fortune it did not seem like much sensitive information out in the open. He added, however, that his research team "didn't try to dig in too much" and immediately alerted Tesla as soon as they learned about the unsecured system.
RedLock's report comes at a time when cryptojacking heists are increasing as the value of cryptocurrency grows.
Two other companies were also being used to mine cryptocurrency as a result of unsecured Kubernetes consoles, a Google-designed application that helps store virtual machines known in the tech space as containers.