Connected Cars Face a New Security Challenge Beyond Their Onboard Computers

When people picture a hacked car, they usually imagine someone breaking into its onboard computer. The data from automotive security researchers suggests the larger exposure lies outside the vehicle: in the cloud servers, mobile apps, charging networks and suppliers that a modern car depends on.

Where attacks are happening

Upstream Security, an automotive cybersecurity vendor, counted 494 publicly reported cyber incidents across the automotive and smart mobility industry in 2025, according to its 2026 report. It said 92 percent of attacks were carried out remotely and 86 percent needed no physical proximity to vehicles or systems. It also said 67 percent of incidents involved telematics and cloud systems, and that application programming interfaces, or APIs, enabled a significant share.

An EE Times column by Egil Juliussen, summarising the same report, said back-end servers such as telematics and application servers were the largest attack vector in 2025. He argued that compromising such a server could let an attacker reach vehicles that are on the road. APIs underpin over-the-air updates, manufacturers' mobile apps, infotainment, charging and billing, he wrote, and attacking them takes little expertise.

Two cautions apply. Upstream sells security products, and its data covers only publicly reported incidents, so it likely undercounts attacks and may emphasise the threats it sells against. Its press release also did not explain how incidents were selected or defined.

Ransomware and the supply chain

Upstream reported that 218 of the 494 incidents, or 44 percent, were ransomware-related, up from 108 in 2024. The largest incident it cited was an attack on a European carmaker that disrupted production and enterprise systems for several weeks. EE Times named the August 2025 attack on Jaguar Land Rover, which it said halted production for more than a month, and noted that attackers can reach manufacturers through third-party suppliers. A cost estimate attributed to NBC News in that column was not verified, so we do not repeat it here.

Moody's Ratings found that, as of December 2025, the automotive sector had the highest share of issuers reporting a cyber incident in the previous 24 months, according to a report of Upstream's findings. Moody's analysts also noted uneven adoption of key cyber controls and supply-chain weaknesses.

Apps, chargers and data

The attack surface now includes everything linked to the car:

• Companion apps. One report said attackers in mid-2025 took remote control of functions such as ignition and door locks through a companion app and demanded payment. The report did not name the vehicle maker, and we could not verify the case independently.
• EV charging. Upstream data show charging-related incidents rose from 4 percent of the total in 2023 to 8 percent in 2025. Juliussen said many chargers and charging apps are vulnerable to remote or physical manipulation, linked to fraud and reliability problems.
• Personal data. Data and privacy breaches were the most common damage type, at 68 percent of 2025 incidents. Categories overlap, so the shares do not sum to 100.

Not every area is worsening. Infotainment-related incidents fell to 11 percent of the total in 2025, according to the same column.

Rules are catching up unevenly

Regulators are focusing on the connected layer too. In the United States, a Commerce Department rule bars certain Chinese and Russian software in vehicle connectivity and automated driving systems from model year 2027 and hardware from model year 2030, according to a Perkins Coie summary. That summary dates from the rule's early 2025 start, and we did not verify its current status. It also noted the rule's future was uncertain under a new administration.

What it means for carmakers and owners

For manufacturers, the findings point to security work on the cloud and supplier side as much as on the vehicle's own electronics. Practices commonly recommended by security professionals include inventorying APIs, limiting access between systems, monitoring suppliers and having recovery plans for ransomware. These are general guidance rather than findings from the sources above.

For owners, the practical exposure is likely to come through accounts and apps. Using strong, unique passwords and multi-factor authentication where offered, and applying software updates, are standard advice. None of the incident data reviewed suggested drivers can eliminate the risk themselves.

The takeaway

Securing a connected car now means securing a network of servers, apps, chargers and companies. The numbers come mostly from one vendor's tally of public incidents, so exact trends should be treated cautiously, but the direction across several sources is consistent: the weak points increasingly sit outside the vehicle.