PSNM, OSW, and Łukasiewicz released a report on cybersecurity for cars and chargers
The Polish Association for New Mobility, together with the Center for Eastern Studies, Łukasiewicz PIMOT, and Łukasiewicz AI, published a report titled “Cybersecurity for New Mobility.” The authors describe how electric vehicles, charging networks, and energy systems can be attacked. They also argue that Poland can benefit from the global cybersecurity market, which is estimated to exceed $300 billion by 2029.
Modern cars often have over 200 million lines of code and around 100 electronic control units (ECUs) connected via communication networks. Therefore, an attacker doesn’t need to be physically near the car; a vulnerability in a mobile app or in the manufacturer’s API (the interface through which the app communicates with the brand’s servers) is sufficient. Such a vulnerability can be used to remotely unlock the car, read its location, or change profile settings. According to ENISA’s 2026 report, transportation accounted for 8% of incidents recorded in the EU.
Data leak of 800,000 cars and footage from drills in Norway
The report cites two cases. In December 2024, it was revealed that telematics data from around 800,000 electric vehicles belonging to one company had been stored in a misconfigured cloud for months, allowing for the precise tracking of the vehicles’ locations. In October 2026, in Norway, Chinese cars automatically and without consent recorded soldiers’ activities, travel routes, and access codes to protected facilities during military exercises. PSNM does not mention Marek in either case.
According to the authors, the charging infrastructure is the most vulnerable. Poland already has over 14,000 public charging stations that accept contactless payments, process customer data, and control power in real time. The report describes a scenario in which an attacker takes control of the operator’s management system and shuts down stations across an entire metropolitan area or along major transportation routes, leaving city and logistics fleets stranded.
The second front is energy. On December 29, 2025, at least 30 wind and solar farms along with a large thermal power plant in Poland were targeted in a cyberattack, while an attack in Ukraine in 2015 left around 225,000 customers without power for several hours.
None of these incidents involved electric mobility. However, smart charging and V2G (vehicle-to-grid, or delivering energy from a car’s battery to the grid) open up new pathways into the electrical system. Whoever takes control of a large fleet of connected cars could trigger coordinated surges in power consumption and delivery, posing a threat to grid stability.
Aleksander Rajch, a board member of PSNM, says, “Cybersecurity cannot be verified once, during homologation. It needs to be checked throughout the vehicle and charger’s lifecycle, after every software update.”
Poland has ambitions, suppliers have gaps
According to PSNM, small and medium-sized suppliers are the weak link, often lacking the resources for proper cybersecurity management, even though their components end up in products critical to security. Meanwhile, internal combustion engine vehicle production in Poland dropped from a record 840,000 units in 2008 to 101,000 units in 2025, yet the sector still provides over 220,000 jobs, accounts for more than 8% of GDP, and generates nearly 33 billion euros in exports. For comparison, the KOMPAS 2035 plan targets one million cars per year by 2035. The report highlights the strong automotive industry, over 600,000 IT specialists, research infrastructure, and the experience of institutions from the eastern flank of the EU and NATO that operate under constant pressure from attacks as advantages.
The recommendations include national laboratories and methodologies for testing the cybersecurity resilience of cars and chargers, a plan to scale up Polish cybersecurity technologies, minimum requirements for public procurement and fleet purchases, as well as a sector-specific information sharing center for threats (ISAC). A complete list, including recommendations for academia and mobility service providers, is available in the report downloadable from the PSNM website. The report does not specify who or when should implement these recommendations.
LovEV Newsletter
Want more content like this?
Sign up — we’ll send you a weekly summary once the newsletter starts.