EV charging infrastructure is rapidly becoming critical infrastructure, deeply integrated with the power grid, payment systems, and user data. As a result, the stakes of any cyberattack are rising: disrupted services, privacy breaches, and even physical accidents or large‑scale grid disturbances.

Cybersecurity Risks in EV Charging:
What Manufacturers, Operators and Municipalities Must Know

As EV adoption accelerates, public and private sectors are racing to build charging infrastructure. But one critical aspect is often overlooked: and that is cybersecurity. EV chargers are now part of a complex digital ecosystem - interacting with vehicles, cloud systems, payment platforms, and even the national power grid.

A vulnerable charging station is more than an inconvenience - it’s a potential entry point for attackers targeting critical infrastructure.

Key Threats to EV Charging Ecosystems

Protocol & Firmware Vulnerabilities
Some EV chargers are exposed to risks like command injection and session hijacking due to outdated firmware or insecure implementations of communication standards like OCPP and ISO 15118.
Backend System Exploits
Compromised Charging Point Management Systems (CPMS) can allow full remote control, customer data theft, and service outages.
Cloud & App Insecurity
Misconfigured APIs, hardcoded credentials, and unencrypted data flows expose mobile apps and cloud backends to abuse.
Network Intrusions
Without network segmentation and strong encryption, attackers can pivot between chargers, backend servers, and other critical systems.
Data Privacy Risks
Location history, payment records, and user credentials are all at risk if not properly encrypted and access-controlled.

EV charger manufacturers need to embrace secure-by-design development:

Use digitally signed firmware and enable secure boot
Deploy tamper-proof hardware with embedded secure elements
Enforce TLS 1.3 encryption and certificate-based authentication
Remove all default or hardcoded credentials
Join vulnerability disclosure programs (e.g. Pwn2Own Automotive)

TIP: Consider using ISO 15118 and OCPP 2.0.1 as your minimum standard for new products and retire legacy protocols like OCPP 1.6.

What Local Municipalities and Public Operators Must Do

Municipal and government-backed charging networks carry additional risks - impacting citizens, traffic and the energy grid. A successful cyberattack on EV charging stations could disrupt transportation or emergency services, impact traffic flow or billing systems, expose citizen data or even interfere with grid stability. Therefore, operators must:

Enforce network segmentation (use VLANs, DMZs and firewall policies)
Enable MFA (multi-factor authentication) and RBAC (role-based access control) across admin interfaces
Implement real-time threat monitoring with SIEM and anomaly detection tools
Maintain consistent patching management for all systems and firmware
Enforce end-to-end encryption (TLS 1.3+) and mutual certificate-based authentication
Align with relevant regulations and standards, such as GDPR (data protection), ISO/IEC 27001 (security management), ISO 15118 (secure charger-vehicle comms), and NIS2 (critical infrastructure cybersecurity)
Develop incident response plans tied to local emergency services and utility companies

TIP: Public-sector RFPs for EV infrastructure should include cybersecurity requirements from day one - not as an afterthought.

Why Cities and Local Governments Should Care

In case of questioning why the above actions and precautions are necessary, here is the list of most important reasons why operators should real the above into consideration:

Public Safety: Over‑ or under‑charging could trigger fires and/or traffic hazards.
Cascading Infrastructure Risk: A coordinated hack could destabilize traffic signals, transit, or healthcare facilities.
Financial & Legal Liability: Breaches invite GDPR fines, lawsuits, and loss of public trust.
National & Energy Security: EV infrastructure is now part of the critical‑energy landscape.

Recent Security Incidents and Identified Vulnerabilities (2023-2025)

These real-world examples (all from the past 18 months) highlight how real and urgent the threat is:

January 2025 - Tesla Wall Connector exploitation at Pwn2Own Tokyo

At the Pwn2Own Automotive 2025 competition in Tokyo, security researchers from teams like PCA Cyber Security (formerly PCAutomotive), Synacktiv, and PHP Hooligans demonstrated multiple vulnerabilities in Tesla’s Wall Connector. Exploits included a numeric-range flaw and an attack via the charging connector itself, leading to full remote code execution. Synacktiv's team notably achieved this in just 18 minutes using a chain of vulnerabilities.

November 2024 - CITA Smart Data Breach Affects 116,000 Users

In November 2024, a significant data breach exposed approximately 116,000 records from multiple global Electric Vehicle (EV) charging network operators. The breach was initially attributed to Tesla; however, it was later clarified that the data originated from a third-party development company responsible for hosting and maintaining information on Tesla’s EV charging stations. The compromised data included sensitive information such as full names, locations, payment details, and vehicle information

June 2024 - Critical Wallbox Vulnerability

In June 2024, a critical vulnerability, CVE-2023-46359, was discovered in the Hardy Barth cPH2 Wallbox. This OS command injection flaw allowed unauthenticated remote attackers to execute arbitrary commands on the system. Exploit code was reportedly traded on dark-web forums, posing a significant risk to unpatched devices.

April 2024 - Six Zero-Day Vulnerabilities in OCPP

In April 2024, researchers identified six zero-day vulnerabilities in Open Charge Point Protocol (OCPP) implementations. These flaws exposed EV charging systems to risks such as backend manipulation, fake session injection, and remote tampering. The vulnerabilities underscored the need for enhanced security measures in OCPP communications.

February 2024 - UK Halts Sales of Spanish EV Chargers

In February 2024, the UK government suspended the sale of imported Spanish EV chargers, including models from Wallbox, due to cybersecurity concerns. The Office for Product Safety and Standards (OPSS) determined that these models did not meet required cybersecurity standards, posing a threat to national energy infrastructure.

Why Action Is Critical

With Vehicle-to-Grid (V2G) pilots expanding across Europe and Asia, cybersecurity researchers warn that attackers could manipulate charging sessions at scale to disrupt grid stability. While not yet directly addressed in legislation, this remains a critical emerging risk to monitor.

EV charging infrastructure is now deeply linked to:

Energy distribution
Mobility services
National infrastructure resilience
Personal data protection

Every unsecured charger is a possible attack vector. Every breach damages public trust. For cities, an unprotected EV network could disrupt transportation, trigger outages, or compromise citizen data.

This is no longer about theoretical threats. The attacks are happening.

Emerging Technical Threats

While regulations catch up, researchers continue to uncover new technical risks in EV charging infrastructure. Early 2025 studies highlight how both the physical layer and the network protocols behind chargers can become attack surfaces:

Weak OCPP implementations – A May 2025 peer-reviewed study in the International Journal of Information Security showed that unencrypted WebSocket connections and poor session handling in OCPP 1.6 expose chargers to risks such as session hijacking, denial-of-service, and firmware theft
AI for intrusion detection - New federated learning–based intrusion detection systems demonstrated in early 2025 achieve >98% accuracy in spotting malicious traffic against EVSE, while preserving data privacy across operators.
Physical-layer exploits (PORTulator) - Researchers unveiled a proof-of-concept hardware implant that can be inserted into the charging connector itself. By spoofing authentication signals, it can cause denial-of-service or even physical damage to both chargers and vehicles.
Multimodal detection frameworks - Advanced AI models are being trained on both network traffic and kernel-level data, showing that multi-layer visibility is key to detecting stealthy attacks against EV charging systems.

Takeaway: 2025 research also underscores that threats are no longer theoretical - attack surfaces now span from the cloud to the charging cable itself.

Action Plan for Stakeholders

Stakeholder	What they need to do now (Immediate Priorities)
Manufacturers	Build security into the product from the start. This includes: Adding tamper resistance to prevent physical hacking Using certificate-based authentication (e.g., TLS with mutual authentication) Enabling secure boot so the device only runs trusted firmware Eliminating backdoors or hardcoded credentials Submitting products for ethical hacking tests (on commercial basis or at contest like Pwn2Own Automotive)
Operators (Cities)	Protect the operational side by: Segmenting networks with firewalls or VLANs Using TLS encryption to secure data in transit Enforcing Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC) for admins Applying security patches regularly Setting up real-time monitoring (e.g., SIEM, anomaly detection)
Regulators	Improve enforcement by: Requiring compliance with cybersecurity standards (like ISO 15118, OCPP 2.0.1) Overseeing adherence to broader regulations like GDPR (data privacy) and PCI DSS (payment data security)
Utilities	Ensure the EV charging infrastructure doesn’t threaten grid stability by: Integrating cybersecurity into grid management systems, especially for Vehicle-to-Grid (V2G) scenarios
EV Drivers / Public	Encourage users to protect themselves by: Updating firmware when prompted Visually inspecting public chargers before use Reporting suspicious behaviour or hardware (e.g., tampered or unsafe stations)

Conclusions

EV charging infrastructure is essential to achieving our decarbonization goals - but it’s increasingly becoming a prime target for cyber threats. To stay ahead of these risks, manufacturers must invest in secure-by-design development, informed by real-world threat intelligence and continuous security validation. Preliminary EV charger penetration testing conducted by PCA Cyber Security can help uncover vulnerabilities early - whether during development or even after deployment - ensuring that any gaps are identified and mitigated before they can be exploited.

In addition, PCA’s product-focused threat intelligence services provide tailored insights into emerging vulnerabilities and attacker behaviour specific to EV charging systems.

Without timely, coordinated defences, local municipalities face the risk of service disruptions, public safety incidents, and cascading impacts across critical infrastructure. The time to build secure, resilient, and trustworthy EV infrastructure is now - not after attackers find the flaws for us.

The PCA Cyber Security Threat Intelligence team has recently conducted in-depth research on EV charger security, and the full report is available upon registration through our website form. This report offers further insights into the risks and attacker techniques targeting charging infrastructure.