EV security fears as chargers at risk of Russia attack

The UK’s electric vehicle charging network is vulnerable to cyber attacks from hostile states like Russia and China that could wreak havoc on roads, The i Paper can reveal. Hackers could target Britain’s rapidly growing public network of 125,000 charging points, which has no specific cyber security measures in place. Home EV chargers – of which there are around 1.4 million in the UK – must already comply with security requirements set out in legislation, but still have vulnerabilities that hackers could exploit, experts say. An attack could take out charging points, leaving motorists unable to power their cars. If several chargers were affected, drivers would be forced to search for alternatives causing disruption on the roads and at forecourts. Recent research by The Hong Kong Polytechnic University also discovered that an attacker need only manipulate EV charging navigation systems to redirect large numbers of vehicles to the same charging station. The stark admission that the UK’s public network of charging points has no uniform security measures was set out in documents published by the Department for Transport. Hackers could carry out “direct attacks on charge points” and these could be “manipulated or misused to compromise other parts of the charging network”, officials warned. This week, unidentified cyber criminals have targeted refrigerators and freezers in hospitals and supermarkets in the UK and Europe to spoil food and blood products. Bomb hoaxes have also caused disruption to flights. It is not known who is behind it but there are fears of links to a hostile state such as Russia given Vladimir Putin has been ramping up so-called grey warfare tactics to put pressure on the West. Fears hostile states will target EV chargers The i Paper has been told there are concerns that hostile powers could stage an attack on EV charging points to attempt to destabilise the country. Labour MP Graeme Downie, chair of the Coalition on Secure Technology campaign group, urged the Government “to be honest with the public that this is a threat”. “Frankly, this is how other states will attack us,” he said. The UK’s EV network is not just vulnerable to cyber attacks. Experts have long warned of how Chinese technology in EVs and charging points could be used by Beijing for espionage and sabotage. One concern about Chinese-made cellular modules, which connect devices such as EV chargers to mobile networks, is that Chinese companies can be compelled under national security laws to assist Beijing’s intelligence agencies and hand over information if requested. A senior security source said that the Chinese are ahead of the Russians in terms of their ability to co-ordinate cyber attacks and sabotage but that this kind of hybrid warfare was how the “tool of choice” for any hostile state. “It feels as if the Government had rather taken their eye off the ball around all of this,” the source added. There are more than two million electric vehicles being used in Britain, including battery electric and plug-in hybrids (Photo by Mike Kemp/In Pictures via Getty Images) The solution The Government is currently consulting on a new requirement for manufacturers to build in cyber security protections for public charging points, similar to those that are already mandatory for home chargers. Domestic chargers must have unique passwords, the ability to receive secure software updates and protections against unauthorised access, such as encrypted systems for communications between the charger, smartphone apps and cloud systems. Experts warn that home charging still has vulnerabilities. A domestic charger is only one part of the wider digital system. For example, a hacker may be able to stage an attack by targeting apps, cloud platforms or software suppliers. Any hack could also pose a threat to public services. The number of local buses and NHS ambulances that are fully electric has been growing in recent years. How a hack could unfold Downie, the MP for Dunfermline and Dollar, said: “You would see disruption of people, businesses and public services all at the same time in a geographically-dispersed way that would make it very hard to isolate what the problem or the fault was.” Highlighting how cyber attacks are often carried out in stages, he said: “It can create a real domino effect where you affect the whole country bit by bit. It could be that it starts in a rural area, but no one notices, or it could start with home chargers [and]… everyone just assumes it is a fault and doesn’t see it as an attack.” He warned that with incoming new EV tech that claims to charge a car to ‘near-full’ in nine minutes, people may begin to leave charging to the last minute, making a possible attack even more disruptive. Any widespread hack would have the ability to destabilise the country, Downie added, and could spread across the nation in a similar way to the refrigerator hacks in Europe. Downie said hackers can now “target more people for longer” and “everywhere at the same time”. “This is about the changing nature of conflict and war,” he added. “It’s no longer about the big bang [of an attack], it’s disruption that rumbles on for days, weeks, and months that spreads and evolves. It is a larger distraction for government as well. There comes to be a panic.” ‘Entire fleet’ of chargers could be targeted Eric Escobar, a principal consultant at Sophos, a British cybersecurity firm, has worked with companies to ethically hack electric chargers to test their defences. He said a motivated hacker could “impact the entire fleet of chargers…. Every threat has a different goal. A nation state might want to shut down or disable the charger, another might be looking for a specific target or charger to know when someone is home, and others might attempt to somehow impact either the payment system or the cost of the electricity provided.” Tougher new cyber security requirements would apply only to new public chargers sold or installed after the rules come into force. Existing charging points will not have to be upgraded, even if they do not meet the new standard. The department says: “We will not require retrofitting.” The Government is also proposing physical protections, such as tamper-proof seals or sensors that can alert operators if someone tries to open a charger and interfere with its internal components. Mike Hawes, Society of Motor Manufacturers and Traders (SMMT) Chief Executive, said: “With private chargers already subject to regulations and vehicle manufacturers meeting stringent cyber security and software update standards, it is right that public charging infrastructure is similarly protected. Doing so will ‘close the loop’, reducing the risk of public charging infrastructure becoming a back door for malicious actors seeking to compromise vehicles or the wider energy system. The DfT’s consultation on the proposed cyber-security requirements for public EV charge points closes on 20 December 2026. What the research says Researchers at the University of Oxford carried out in 2022 also demonstrated how rapid EV charging can be disrupted remotely, in this case from around 50 metres away. The attack worked by interfering with communications between the vehicle and charger, causing the charging session to stop. The vehicles tested would only resume charging once a driver had unplugged and reconnected the cable, and interference had stopped. Multiple vehicles could be disrupted at the same time, the researchers found, prompting them to warn this could be particularly problematic for bus, taxi and HGV fleets that rely on frequent rapid charging. More recent research from The Hong Kong Polytechnic University published in February of this year said hackers could manipulate EV charging navigation systems to direct large numbers of vehicles to one charging station to potentially destabilise the electricity grid. They said cyber attacks on a country’s power grid were difficult and costly, and that driver-facing charging systems are far less well-protected making them a more accessible entry point for hackers.