UK Electric Vehicle Charging Network Faces Cybersecurity Concerns Amid Warnings of Potential Attacks

Britain’s expanding electric vehicle charging network is facing renewed cybersecurity scrutiny following warnings that charging infrastructure could be vulnerable to attacks by hostile state actors, including Russia. However, while the prospect of coordinated disruption has raised concerns, available research points to a more immediate problem: widespread reliance on ageing communication protocols and insufficient encryption across connected charging systems.

A report circulated by The i Paper has raised concerns about the possibility of foreign cyber operations targeting the United Kingdom’s electric vehicle charging infrastructure.

The warning comes as governments and security researchers increasingly examine the risks associated with connecting thousands of charging stations to centralised management platforms and electricity networks.

However, the available evidence does not establish that Russia is currently conducting a coordinated campaign against British EV charging facilities.

Instead, recent cybersecurity investigations have documented technical weaknesses that could potentially be exploited by a range of malicious actors, including cybercriminals and state-sponsored groups.

Research published by threat intelligence company Flare in August 2026 found that 72 per cent of a sample of 1,000 internet-facing EV charging endpoints accepted connections without transport-layer encryption.

The findings highlight a significant challenge for charging operators as infrastructure deployment continues to expand faster than some legacy systems are being secured.

While researchers have demonstrated several ways charging equipment can be compromised, evidence of a coordinated attack capable of disrupting Britain’s electricity grid remains limited.

Growing Concerns About EV Charging Security

Electric vehicle charging infrastructure has become an increasingly important part of Britain’s transport and energy systems.

Public charging stations, commercial fleet facilities and residential charging equipment depend on interconnected technologies to authenticate users, manage payments, monitor equipment and coordinate electricity consumption.

Many charging stations communicate with remote management systems, allowing operators to adjust settings, diagnose faults and control charging activity.

These capabilities support efficient network operation but also introduce potential cybersecurity risks.

An attacker who successfully compromises a charger or its management platform could potentially interfere with charging services, manipulate operational settings or access information transmitted between connected systems.

In more serious scenarios, researchers have examined whether coordinated interference with large numbers of chargers could affect electricity demand and create additional pressure on power networks.

Such possibilities have contributed to concern about the potential involvement of hostile states.

However, the distinction between an identified vulnerability, a demonstrated attack technique and an active cyber campaign is important.

Although the recent media reporting has highlighted the possibility of Russian involvement, the material available does not establish a current state-sponsored operation targeting British charging infrastructure.

Previous Incidents Demonstrate Real-World Risks

Cybersecurity researchers have documented several incidents involving compromised EV charging equipment.

During the Russia-Ukraine conflict, charging stations in Russia were reportedly manipulated to display messages supporting Ukraine, disrupting their normal operation.

Separate incidents in the United Kingdom involved charging stations being hijacked to display inappropriate material.

These cases demonstrate that connected charging systems can be vulnerable to unauthorised interference.

However, the available accounts do not establish that Russian state-sponsored attackers were responsible for the incidents in Britain.

A separate historical case involved charging infrastructure along Russia’s M11 motorway between Moscow and Saint Petersburg.

According to threat intelligence company Flare, charging stations were disabled after a Ukrainian supplier allegedly used access embedded within the equipment’s internal controllers.

The incident reportedly forced the operator to take affected infrastructure offline for maintenance.

That account concerns a potential supply-chain compromise rather than the same type of attack involved in the earlier charging station defacements.

It is also based on secondary reporting rather than independently verified technical evidence available for this assessment.

Together, these incidents illustrate several different potential attack methods, but they do not establish the existence of a current coordinated campaign against UK charging networks.

Research Finds Widespread Encryption Weaknesses

One of the clearest indications of potential exposure comes from research conducted by Flare between 14 June and 14 July 2026.

The company examined 1,000 internet-facing EV charging endpoints distributed across 56 countries.

Its investigation found that 720 endpoints, representing 72 per cent of the sample, accepted connections without Transport Layer Security, commonly known as TLS.

TLS is an encryption technology designed to protect information exchanged between connected systems from interception or unauthorised modification.

Without adequate transport encryption, communications between a charging station and its management platform may be exposed to interception, depending on the network environment and other protections in place.

These communications can include authentication information, charging session instructions and messages associated with payment or backend management systems.

The findings raise concerns about whether some operators are adequately protecting data and commands transmitted across public networks.

However, the research has important limitations.

Flare’s investigation examined a selected population of internet-accessible endpoints rather than every charging station operating globally.

The findings cannot therefore be interpreted as demonstrating that 72 per cent of all EV chargers lack encryption.

Nor does the ability to establish an unencrypted connection necessarily prove that attackers can control charging equipment or manipulate electricity demand.

Flare explicitly acknowledged that its research demonstrated exposure rather than the ability to execute a coordinated attack against the power grid.

Nevertheless, the results indicate that insecure communications remain a significant concern within the observed infrastructure.

Why Older Charging Protocols Remain a Problem

A central issue involves the Open Charge Point Protocol, or OCPP, the communication standard widely used to connect EV charging stations with central management systems.

Developed to support interoperability between different charging manufacturers and software providers, OCPP allows operators to manage equipment without relying exclusively on proprietary systems.

However, older versions were developed when the cybersecurity requirements of charging infrastructure were less mature.

OCPP 1.6, released in 2015, remains widely deployed throughout the industry.

Although security enhancements and TLS-based protections can be implemented with OCPP 1.6, advanced security capabilities have not been consistently deployed across existing installations.

As a result, some chargers continue to communicate with management systems without encrypted transport connections.

Newer versions, including OCPP 2.0.1 and OCPP 2.1, provide more developed security functionality, including improved authentication and certificate-based protections.

However, migrating existing infrastructure to newer protocols can involve equipment compatibility issues, software upgrades and additional investment.

Some operators may also depend on older charging hardware that cannot readily support newer security requirements.

These challenges have contributed to the continued use of legacy systems even as cybersecurity expectations have increased.

Flare reported that newer OCPP implementations appeared relatively infrequently within its sample, suggesting that adoption of more secure configurations remains uneven.

German Research Highlights Additional Vulnerabilities

Separate research reported by charging software company AMPECO has raised further concerns about the cybersecurity maturity of electric vehicle charging infrastructure.

In May 2026, AMPECO summarised findings from an assessment by Germany’s Federal Office for Information Security, known as BSI.

According to that summary, 81 of 122 identified Common Vulnerabilities and Exposures affected electric vehicle supply equipment.

The assessment also examined weaknesses involving management systems, communication protocols and charging infrastructure components.

AMPECO reported that only 12 per cent of charging points supported TLS, while 91 per cent of certified products remained associated with OCPP 1.6.

These figures concern different measurements and populations from Flare’s investigation and should not be combined into a single estimate of global exposure.

The original BSI report was not independently examined for this account, meaning the figures remain attributed to AMPECO’s published summary.

Nevertheless, both investigations raise similar concerns about inconsistent security implementation and the continued reliance on older technology.

The findings also highlight the distinction between having modern cybersecurity standards available and ensuring they are implemented throughout operational charging networks.

Researchers Demonstrate Charger Exploits

Controlled security testing has provided further evidence that EV charging systems can contain exploitable vulnerabilities.

At the Pwn2Own Automotive 2026 competition, researchers demonstrated attacks against charging equipment and other connected vehicle technologies.

According to reports from the event, participants disclosed 76 unique vulnerabilities across the competition’s automotive targets.

The event included Level Three high-powered charging equipment as a target category for the first time.

Among the demonstrations was an exploit involving an Alpitronic HYC50 charger, where researchers achieved a compromise through the charging connector.

Another demonstration targeted an Autel MaxiCharger using its near-field communication interface, illustrating how features designed for convenient user interaction can introduce additional security risks.

AMPECO’s summary of the German BSI assessment separately referred to 54 newly identified vulnerabilities across ten charger models, with approximately half potentially allowing attackers to execute code with elevated privileges.

These figures describe different research scopes and should not be added together.

Importantly, security competitions take place under controlled conditions with the participation of researchers and equipment vendors.

Successful demonstrations establish that particular vulnerabilities can be exploited under the tested conditions.

They do not demonstrate that criminals have used those techniques against public charging networks or that an attack has disrupted electricity supplies.

Could Hackers Disrupt the Electricity Grid?

Beyond individual charging stations, cybersecurity researchers have examined whether attackers could manipulate large numbers of connected chargers to interfere with electricity demand.

Modern charging networks increasingly use software to schedule charging sessions, balance electrical loads and coordinate energy consumption.

These capabilities can help reduce pressure on electricity networks by shifting demand away from peak periods.

However, compromised management systems could theoretically allow an attacker to interfere with charging schedules or simultaneously change the operating behaviour of connected equipment.

Academic research has explored scenarios involving compromised charging servers, mobile applications and interconnected vehicles.

Some studies have examined the possibility of using large numbers of charging devices to produce sudden changes in electricity demand.

In sufficiently severe circumstances, such activity could potentially affect grid stability or contribute to localised disruption.

However, these scenarios remain risk assessments rather than evidence of a successfully executed large-scale grid attack.

The feasibility and consequences would depend on numerous factors, including the number of devices compromised, the electrical capacity under attacker control, protective measures and the ability of grid operators to respond.

The vulnerabilities identified in individual chargers do not automatically establish that attackers could coordinate them at sufficient scale to disrupt an electricity network.

Nevertheless, the potential consequences have made charging infrastructure security an increasingly important issue for energy regulators and infrastructure operators.

Industry Standards Are Evolving

The Open Charge Alliance, which oversees the development of OCPP, has continued introducing additional guidance intended to strengthen cybersecurity across the industry.

In September 2026, the organisation released the second version of its Security Operations Guide.

The updated document provides practical recommendations for charging station manufacturers, charge point operators and charging management system providers.

It expands guidance concerning security responsibilities, operational controls and the protection of interconnected charging systems.

The revised guide also introduces additional material addressing defence-in-depth strategies, local controllers and preparations for post-quantum cryptography.

Defence in depth involves using multiple protective measures so that the failure of one security mechanism does not necessarily allow an attacker to compromise an entire system.

The guidance is intended to help organisations translate cybersecurity requirements into practical operating procedures.

However, publishing new standards does not guarantee their adoption.

Existing charging infrastructure may remain dependent on older hardware, outdated configurations or management platforms that require significant changes before stronger protections can be introduced.

The effectiveness of the revised guidance will therefore depend on manufacturers, software providers and charging operators implementing the recommended controls.

UK Government Moves Towards Stronger Regulation

British authorities are also developing additional cybersecurity requirements for organisations responsible for managing significant electrical loads.

The Cyber Security and Resilience Bill proposes expanding the scope of the UK’s Network and Information Systems Regulations to include certain large load controllers.

These organisations manage electrical demand through connected technologies such as smart EV chargers, battery storage systems and other energy management equipment.

Under the proposed framework, load controllers managing a combined potential electrical capacity of at least 300 megawatts could become subject to additional cybersecurity and incident reporting requirements.

The Department for Energy Security and Net Zero and energy regulator Ofgem would share responsibility for overseeing the relevant organisations.

The proposed measures reflect concerns that compromised systems coordinating large volumes of electricity demand could create consequences extending beyond individual charging stations.

However, the legislation had not completed its parliamentary passage as of 9 November 2026.

Following consideration in the House of Lords, the Bill was awaiting further parliamentary stages before Royal Assent.

Implementation would also require secondary legislation and supporting regulatory guidance.

Consequently, the proposed requirements should not be interpreted as already applying to every charging provider.

The framework targets particular operators whose control over electrical demand meets the relevant threshold, rather than establishing identical obligations for all public charging stations.

What Charging Operators Can Do Now

Despite uncertainty surrounding the reported state-sponsored threat, the identified technical weaknesses provide charging operators with practical areas for improvement.

Flare has recommended that organisations ensure communications between charging stations and management systems are protected using appropriate encryption.

Where supported, operators should consider modern OCPP implementations with certificate-based authentication and properly configured TLS connections.

For installations that cannot immediately migrate from OCPP 1.6, additional network protections can help reduce exposure.

These include using virtual private networks or private cellular connections to prevent charging communications from being transmitted openly across public networks.

Operators should also verify whether their equipment accepts unencrypted connections and work with manufacturers to identify available security updates.

Beyond communication encryption, organisations need appropriate controls for device access, firmware updates, backend systems and administrative accounts.

Regular vulnerability assessments and monitoring can help identify weaknesses before they are exploited.

However, no single security measure addresses every risk associated with charging infrastructure.

Encrypting communications may reduce the likelihood of interception or manipulation in transit, but it does not necessarily prevent attacks involving compromised firmware, physical interfaces or vulnerable management software.

A comprehensive security strategy must therefore address the full charging environment, from individual devices through to central management platforms and connected electricity systems.

The Challenge of Securing an Expanding Network

The growing importance of electric vehicle infrastructure has created a cybersecurity challenge for governments, manufacturers and charging operators.

As the number of connected charging stations increases, so does the potential impact of vulnerabilities affecting commonly used software, hardware and management systems.

The recent warnings concerning possible Russian attacks have brought renewed attention to that issue.

However, the available evidence does not establish that Britain is currently facing a coordinated Russian campaign against its electric vehicle charging network.

What researchers have demonstrated is more specific: a significant proportion of the internet-facing endpoints examined in one investigation accepted unencrypted connections, while separate assessments identified vulnerabilities in charging equipment and management technologies.

These findings do not establish that the electricity grid is vulnerable to immediate large-scale disruption.

They do indicate that some existing infrastructure requires stronger security controls and that the transition towards more secure technologies remains incomplete.

For charging operators, the priority is identifying exposed systems, securing communications, addressing known vulnerabilities and ensuring that future procurement decisions include appropriate cybersecurity requirements.

For regulators, the challenge is developing proportionate and enforceable standards that can keep pace with the rapid expansion of connected energy infrastructure.

The immediate concern is not evidence of an ongoing foreign attack, but the possibility that existing weaknesses could provide opportunities for one.

Addressing those weaknesses before they are exploited will be essential to maintaining confidence in the reliability and security of Britain’s electric vehicle charging network.

Optional encryption is a decision somebody has to make, and a link that keeps working in the clear is usually one where nobody made it. Reading a specification for the difference between TLS being available and TLS being required gets easier once the machinery underneath makes sense: what a certificate actually proves, why mutual authentication matters when both ends are machines, and what an eavesdropper gains from traffic that was never wrapped at all. Those ideas sit at the centre of cryptography, which is where the reasoning behind encrypted transport is usually taught. Readers who want to build that understanding can explore The Hack Academy’s online cybersecurity training programme, where cryptography is one of the listed subject areas, with self-paced learning and practical exercises alongside the theory in authorised, controlled environments. It will not audit a charge point operator’s estate, but it makes the question of what is actually encrypted a good deal clearer.