LIBERTYVILLE, Ill. (WTVO) — Volkswagen says a “serious breach” of its security protocols resulted in a delay in tracking a stolen SUV with a toddler trapped inside.

The incident started on the afternoon of Feb. 23 when a 36-year-old woman — who was 6 months pregnant — returned to her Libertyville, Illinois home with her two children. She brought one child inside and was walking back to her vehicle to get her 2-year-old son out of the car when a 2000s model BMW pulled into her driveway, parking behind her, the Lake County Sheriff’s Office said.

A tall, thin man in a zip-up hooded sweatshirt and green face mask then forced his way into the woman’s Volkswagen as she tried to fight him off and protect her child, officials said. The man attacked her, knocking her to the ground and managing to steal her car with the boy still inside.

As they drove from the scene, one of the two men ran her over, causing “serious injuries to her extremities,” sheriff’s officials said, but the woman managed to call 911.

The Lake County Sheriff’s Office said in a Facebook post that detectives immediately contacted Volkswagen Car-Net, which allows the car manufacturer to track its cars, but the company “would not track the vehicle with the abducted child until they received payment to reactivate the tracking device in the stolen Volkswagen.”

Detectives got a break when they received a 911 call from someone working at a Waukegan business who reported seeing two vehicles enter the parking lot and the driver of one of the vehicles abandon a small child, the release said. The caller brought the child – the one who had been abducted – in from the parking lot “before the child wandered onto the busy roadway.”

Authorities later tracked down the stolen SUV in a different parking lot, according to sheriff’s officials. The mother of the two children was taken to the hospital in stable but serious condition.

The Chicago Sun-Times reported that a detective implored a representative at Car-Net to release the vehicle’s location, citing the “extremely exigent circumstance,” but the representative wouldn’t budge.

“The detective had to work out getting a credit card number and then call the representative back to pay the $150, and at that time, the representative provided the GPS location of the vehicle,” sheriff’s office Deputy Chief Christopher Covelli told the paper. By the time the payment was sorted out, however, the GPS location was no longer necessary.

Volkswagen later released a statement, saying, “Volkswagen has a procedure in place with a third-party provider for Car-Net Support Services involving emergency requests from law enforcement. They have executed this process successfully in previous incidents. Unfortunately, in this instance, there was a serious breach of the process. We are addressing the situation with the parties involved,” according to NBC News.

Nexstar reached out to Volkswagen for further comment but didn’t immediately receive a reply.

As of Wednesday, police were still searching for the BMW, which was reported stolen from a dealership in Waukegan.