An EV charging cyberattack could, in theory, threaten a city’s power grid without anyone breaking into the grid itself. That is the warning from researchers at The Hong Kong Polytechnic University (PolyU), who say attackers would only need to manipulate EV charging navigation systems to send many vehicles to the same station at once. According to a PolyU media release dated October 20, 2026, the study has been published in IEEE Transactions on Transportation Electrification. This article is based on that release.
How the EV charging cyberattack would work
Most cyberattacks on power systems need to break into the grid’s secure, dedicated communication networks, which PolyU says is difficult and costly. Driver-facing charging navigation apps are far less well protected, making them an easier entry point.
In PolyU’s scenario, an attacker manipulates the charging prices or traffic data used by a navigation app so that one station looks like the best choice. An illustration released with the study shows a hacker making “Station B” seem fastest, at eight minutes, luring several vehicles there at once. If enough EVs arrive in a short time, the concentrated demand could trigger local power outages or reduce grid reliability, the researchers say.
Sparse attacks, big effects
The team says it demonstrated the risk using “sparse vector attacks” on charging prices and traffic flow data. In plain terms, this means injecting a small number of carefully chosen false data points to mislead a system’s decisions. The study argues that such an attack can start outside the electricity distribution network and spread through drivers’ charging behaviour until it threatens the grid’s secure operation.
The research looks at the growing overlap between cyber-physical transportation systems, which use communication networks for traffic monitoring, routing and mobility management, and cyber-physical power systems, which use them to monitor, protect and control generation, transmission and distribution. PolyU says their integration drives innovation but also creates weak points attackers could exploit.
Who led the study and why
The research was led by Prof. BU Siqi, Associate Head (Research) and Professor in PolyU’s Department of Electrical and Electronic Engineering. “This research highlights how a cyberattack originating in one system can spread to another,” Prof. Bu said. “By demonstrating the destructive potential of cross-domain attacks, we aim to raise public awareness and encourage stronger preventive measures.”
He added that as EVs become more popular, “the connection between transportation and power systems will only grow closer, making cybersecurity increasingly vital.” For another look at hidden attack routes, see our report on DivNet and voice assistant attacks.
Defences the researchers propose
The study does not stop at the threat. PolyU says it proposes concrete defensive measures, including:
- enhanced monitoring for abnormal price and traffic signals
- stronger protection of communication links
- earlier detection of unusual recommendation patterns in EV charging navigation systems
Prof. Bu’s team has also started working with Tianjin University, China Southern Power Grid and CLP Power on a joint project on defence methods for distributed energy resources in Greater Bay Area megacities.
How worried should drivers be?
There are two ways to read this. On one side, the study points to a realistic gap: consumer apps are rarely protected like grid control systems, yet they can now move physical load around a city. On the other side, the release describes a demonstrated attack method and potential risks, not a real-world incident. It does not give figures on how many vehicles would be needed, how large an outage could be or which apps might be vulnerable. It also does not say how existing grid protections would respond.
My view on the EV charging cyberattack risk
As a writer, I feel this is a useful early warning rather than a reason to panic. The idea that a few fake prices could steer real cars and stress a real grid is a good reminder that security has to cover the whole chain, not just the obvious targets. As EV adoption grows, including in India, I hope charging app makers and grid operators start sharing data on unusual patterns before anyone tries this for real.
FAQ: EV charging cyberattack
What did PolyU discover?
PolyU researchers showed that manipulating charging prices and traffic data in EV charging navigation apps could send many vehicles to one station, concentrating demand and potentially threatening the local power grid.
Has this attack happened in real life?
The release describes a potential attack method demonstrated in research. It does not report any real-world incident.
How can it be prevented?
The study proposes better monitoring of abnormal price and traffic signals, stronger protection of communication links and earlier detection of unusual recommendation patterns in navigation systems.