INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY

Threat Landscape: Top Cyber Threats Facing Automotive and Mobility

The 18 most relevant cyber threats, attacks and industry challenges for OEMs, component suppliers, EV and battery makers, charging networks, dealers, mobility platforms and fleet providers, and the impact each one has.

Automotive attracts ransomware groups because plants, suppliers and dealers cannot stop without immediate, visible loss; it attracts data thieves because dealers, apps and fleets hold customer, financial and location data at scale; and it attracts researchers and criminals alike because flaws in apps, APIs and telematics reach the vehicle itself. The attack surface spans PLM and software pipelines, just-in-time suppliers, plant OT, shared dealer platforms, OTA systems, charging back-ends and fleet telematics.

Recent incidents show the pattern. Toyota (2022) lost a day of output at 14 plants when one supplier was hit; CDK Global (2024) put about 15,000 dealerships on paper for two weeks and reportedly paid a US$25 million ransom; Jaguar Land Rover (2025) halted global production for about five weeks at an estimated economic cost of £1.9 billion; and researchers have shown in several OEM cases that dealer-portal and app API flaws allow vehicles to be located, unlocked and started remotely. In India, an automotive engineering-services company disclosed a ransomware incident in early 2025.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by automotive and mobility segment (Codec Networks assessment).

4.1 Ransomware across the OEM ecosystem

JLR's 2025 shutdown showed how one intrusion can stop every plant, freeze dealers and idle thousands of suppliers for weeks. Entry is often through a supplier's or vendor's credentials rather than the OEM's own perimeter.

• Questions to test: Can plants run if corporate IT is down? Are backups immutable and restores tested for ERP, MES and dealer systems? Do we monitor supplier and vendor identities? Have we rehearsed a multi-week outage with suppliers and dealers?
• Relevant services: segmentation, backup and recovery testing, identity monitoring, SOC, ecosystem crisis exercises.

4.2 Apps, APIs and the vehicle

Companion apps and dealer portals usually share back-end APIs. Authorisation flaws in vehicle binding, ownership transfer or dealer functions have repeatedly let researchers control cars by VIN or number plate.

• Questions to test: Have app and dealer APIs been tested for authorisation flaws? Are vehicle commands rate-limited and monitored? Is there a vulnerability disclosure process and a vehicle-affecting incident playbook?
• Relevant services: API and app testing, TARA, command monitoring, disclosure and incident processes.

4.3 OTA and the software supply chain

OTA turns a compromised build pipeline or signing key into a fleet-wide compromise. AIS 190 and UN R156 require a managed software update process.

• Questions to test: Who can sign and release updates? Are pipelines and keys protected? Is there an SBOM for each ECU? Can updates be rolled back safely?
• Relevant services: OTA pipeline review, signing and key management, SBOM and dependency review, SUMS readiness.

4.4 Charging and payments

Charge point operators run back-ends that command thousands of chargers and take card payments; weak admin interfaces and OCPP implementations expose both.

• Questions to test: Is the backend admin interface hardened with MFA and segmented? Are charger credentials unique and firmware managed? Are payment flows PCI DSS aligned?
• Relevant services: backend and OCPP assessment, charger firmware review, payment security.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours; listed companies disclose quarterly; AIS 189 expects monitoring of vehicle cyber threats in the field. Plants and vehicle clouds are often unmonitored.

• Questions to test: Do we monitor plants, vehicle commands and remote sessions 24x7? Is there a playbook covering containment, safe plant operation, vehicle-affecting incidents, CERT-In reporting and disclosure?
• Relevant services: IT/OT SOC with vehicle-cloud monitoring, playbooks, joint drills.

• CERT-In: incidents reported within six hours of noticing them.
• AIS 189/190 (once notified): vehicle cyber incidents and software update failures become type-approval and field-monitoring matters with MoRTH and test agencies.
• SEBI LODR: listed OEMs and suppliers disclose cyber incidents quarterly.
• DPDP: incidents involving customer, vehicle, location or driver data trigger breach intimation once provisions commence in May 2027.
• OEM and export customers: contracts require incident notification; UN R155 markets and the EU CRA require vulnerability and incident reporting for connected products.
• Payment networks and insurers: charging and dealer payment incidents trigger PCI DSS obligations; insurers require prompt notification.

• If corporate IT went dark tonight, would our plants and dealers keep working?
• Which supplier or platform provider could stop us, and have we assessed them?
• Could an attacker reach a vehicle through our app, dealer portal or telematics API?
• Who can sign and release an OTA update, and is the pipeline protected?
• Are our chargers, back-ends and payment flows tested and monitored?
• Are we ready for AIS 189/190, and could we report an incident to CERT-In within six hours?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.