Plugged In and Hacked: The Dirty Secret Behind EV Charging

 

Your EV charger may be a loaded gun: hackers can shut down your car, steal your payment data, or slip malware into your vehicle—while you stand there smiling at a charging screen.

I keep hearing the same sales pitch every time I pass a glowing EV charger in a mall parking lot or highway rest stop. Clean future. Smart mobility. Plug in and relax. The problem is that relax is exactly what attackers count on. While drivers watch their battery percentage climb, some EV charging stations have been quietly exposed as soft targets—machines that can be poked, prodded, and in some cases turned against the very cars they are supposed to serve. When the gate is left open, thieves do not knock.

The uncomfortable truth is that some EV chargers were found vulnerable to attacks that could disable a vehicle, steal payment details, or infect a car’s software. This is not sci-fi paranoia. It is the predictable outcome of rushing hardware into public space faster than security thinking can keep up. We built a rolling computer ecosystem, bolted it to the power grid, connected it to payment systems, and then acted surprised when hackers showed up like uninvited guests at an open bar.

I remember watching early demonstrations from security researchers and thinking the tone was almost apologetic. Nobody wanted to be the bad guy who spoiled the electric party. But the data did not care about feelings. In 2022, researchers at Pen Test Partners publicly demonstrated how weaknesses in certain consumer and public EV chargers could be abused. They showed that with relatively modest access, an attacker could interrupt charging sessions, manipulate charger behavior, and potentially pivot deeper into connected systems. That year mattered because it shattered the myth that chargers were just “dumb plugs.” They are networked computers with ports, protocols, and privileges.

The bigger picture became clearer in 2023 and 2024 when industry-wide assessments landed with a dull thud instead of a bang. NCC Group released findings showing that a significant percentage of tested EV charging ecosystems contained high-risk vulnerabilities. In several environments, insecure communication protocols and weak authentication controls made it possible to interfere with charging operations or access sensitive backend systems. Some chargers accepted commands they should have rejected. Others trusted devices they should have questioned. Trust, when given freely, is often stolen.

Disabling a vehicle sounds dramatic, but it is not magic. Modern EVs constantly talk to chargers. They negotiate power levels, authenticate sessions, and exchange status data. If that conversation is hijacked or corrupted, charging can be stopped cold. In edge cases, misconfigured systems could trigger fault states that prevent a vehicle from charging properly until it is reset or serviced. Imagine being stranded not because your battery died, but because a stranger told your car to stop listening to you. That is not just inconvenience; that is leverage.

Then there is the money trail. Public EV chargers process millions of transactions every day. In 2023 alone, global public charging sessions exceeded 1,000,000,000, according to widely cited industry estimates. Each tap, swipe, or app-based payment is a data event. Where there is payment data, there is temptation. Security analysts have repeatedly warned that poorly secured chargers could expose card details or account credentials, especially when operators fail to properly segment payment systems or encrypt data in transit. Traditional gas pumps taught us this lesson years ago. Credit card skimmers thrived there because nobody expected a fuel nozzle to be a crime scene. EV chargers risk repeating that history with newer, shinier hardware. The costume changes, but the con stays the same.

The most unsettling scenario is software infection. EVs are computers on wheels, running millions of lines of code. They receive updates over the air, rely on third-party libraries, and interface with external systems like chargers using standardized protocols such as OCPP. If a charger is compromised, it can become a delivery mechanism. Security researchers have shown that malicious payloads can be positioned where vehicles or backend systems might ingest them, especially in ecosystems where update validation is weak or logging is poor. No credible researcher claims hackers can instantly “take over” every EV on the road, but that is a straw man. Real attackers play the long game. They plant, observe, escalate. Water does not break stone in a day.

History backs this up. In 2015, long before EVs dominated headlines, security researchers demonstrated remote exploitation of connected vehicles through entertainment systems. That moment forced automakers to confront the reality that connectivity equals attack surface. EV chargers are now part of that surface. In 2021, security analysts warned that critical infrastructure attacks were shifting toward edge devices—small, widely deployed systems that are hard to monitor at scale. EV chargers fit that profile perfectly. They sit in public, often unattended, running firmware that may not be patched for years.

Statistics sharpen the edge of this argument. A 2024 industry survey found that more than 60% of charging operators struggled to maintain consistent security updates across their networks. Another assessment reported that over 40% of tested charging systems exposed at least one critical vulnerability related to authentication or data handling. These are not fringe numbers. They describe an ecosystem still learning how to defend itself while already under load.

I can already hear the counterargument whispered in glossy boardrooms. No confirmed mass attacks. No viral meltdown. No reason to panic. Fair enough. Panic is useless. But denial is worse. Cybersecurity history is littered with warnings that were ignored because the damage had not yet scaled. Retail breaches, hospital ransomware, pipeline shutdowns—all of them followed the same script. Early warnings. Limited incidents. Then a single coordinated strike that turned complacency into headlines.

What makes this story alarming is not that EV chargers have vulnerabilities. Everything does. What stings is the mismatch between the green utopia narrative and the gritty reality of rushed infrastructure. We told drivers to trust the plug without telling them about the locks. We celebrated innovation while quietly accepting shortcuts. A fast road still leads to the same cliff.

Yes - you heard me right.  I am not an outsider throwing stones. I use technology. I believe in progress. But belief without scrutiny is how systems rot from the inside. EV charging networks are critical infrastructure now. They deserve the same paranoia we apply to power grids and financial networks. Harden the protocols. Enforce authentication. Patch relentlessly. Audit constantly. Because the next attack will not announce itself with flashing lights. It will look like a glitch, a declined payment, a car that just will not charge.

When that happens, we will pretend to be shocked. We should not be. The warning signs are already plugged in, humming quietly at the curb, waiting for someone curious enough—and careless enough—to listen.

 

 This article stands on its own, but some readers may also enjoy my Brief Book Series titles. Read it here on Google Play: Brief Book Series.