INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY

Five New Case Studies in Automotive and Mobility Security

Original 2026 case studies, each written as a blog post, showing how current threats play out across OEMs, suppliers, dealers, charging networks and fleets and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Five-Week Shutdown 3.  Case Study 2: The Dealer Platform That Went Dark 4.  Case Study 3: The App That Unlocked Any Car 5.  Case Study 4: The Charging Network Held to Ransom 6.  Case Study 5: The Fleet That Drove Blind

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in automotive and mobility with the obligations that apply in India as of October 2026—in particular CERT-In's Directions, SEBI disclosure for listed companies, DPDP, AIS 189/190 and the OEM and export requirements that reach Indian companies.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Five-Week Shutdown	Vehicle OEM	Ecosystem-wide ransomware	CERT-In; SEBI LODR; lenders	B3, B7, B10
2. The Dealer Platform That Went Dark	Dealer group and DMS provider	Ransomware at a shared SaaS provider	CERT-In; DPDP; OEM standards	B9, B2, B10
3. The App That Unlocked Any Car	EV manufacturer	API authorisation flaw reaching vehicles	AIS 189; DPDP; CERT-In	B2, B11, B7
4. The Charging Network Held to Ransom	Charge point operator	Backend takeover via weak admin access	PCI DSS; Ministry of Power guidelines; CERT-In	B1, B3, B7
5. The Fleet That Drove Blind	Fleet telematics provider	Cloud breach via leaked API key	DPDP; contracts; CERT-In	B2, B6, B7

No plant was attacked directly. Every plant stopped anyway.

At a glance
Organisation	A listed vehicle OEM (“Autoco A”) with three plants, 400 dealers and 1,200 suppliers
Threat	Ransomware entering through a supplier's VPN credentials and spreading across ERP, MES and dealer systems
Why it is new	The modern OEM is an ecosystem; one intrusion can stop all of it
Codec Networks services	Segmentation and recovery, SOC, ecosystem crisis exercises (Bundles B3, B7, B10)

The scenario

Attackers bought VPN credentials belonging to a tier-2 supplier's engineer and used them to enter Autoco A's network, where supplier access was not segmented from corporate systems.

Over three weeks they took domain control unnoticed and then encrypted ERP, MES, parts-ordering and dealer-registration systems in one night. The plants were untouched, but could not be sequenced; dealers could not register or deliver cars; suppliers received no call-offs.

Production stopped for five weeks. Autoco A disclosed the incident, sought lender support for suppliers and faced a Board inquiry into why a supplier's credential could reach everything.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Supplier access was not segmented from corporate and plant systems.
• Plants depended on corporate IT with no independent operation.
• Backups were reachable and restores untested.
• Identity and EDR alerts were not monitored 24x7.

The impact

Autoco A lost five weeks of output, disclosed the incident under SEBI LODR, supported idle suppliers financially and rebuilt its identity, segmentation and recovery architecture.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Lenders and insurers: evidence of controls and recovery demanded.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Supplier access segmentation, plant independence, immutable backups and tested restarts	B3
Detect early	24x7 SOC with identity and EDR monitoring and threat hunting	B7
Rehearse the ecosystem	Crisis exercises with plants, suppliers, dealers and regulators	B10

Key lessons Segment supplier and vendor access. Make plants able to run without corporate IT. Keep backups immutable and test restarts. Monitor identities and endpoints around the clock.

Four hundred showrooms, one provider, no deals for two weeks.

At a glance
Organisation	A dealer group (“Dealco B”) using a dealer management system shared by 400 dealerships
Threat	Ransomware at the DMS provider encrypting sales, finance, service and parts systems and leaking customer and loan data
Why it is new	Shared platforms turn one incident into an industry outage
Codec Networks services	SaaS assurance, portal testing, playbooks (Bundles B9, B2, B10)

The scenario

The DMS provider was hit by ransomware. Within hours, Dealco B's showrooms could not quote, finance, register or service vehicles, and the parts system was down.

Sales moved to paper and spreadsheets; financing and registration slowed to a crawl; service bays emptied. The attackers published customer identity and loan documents taken from the provider.

Dealco B had never assessed the provider, held no offline customer list and had no manual-operation playbook. Normal operations resumed after two weeks; customer complaints and a DPDP exposure lasted much longer.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• The DMS provider had never been assessed and its backups were unknown.
• No contractual security, notification or recovery commitments.
• No manual-operation playbook for dealers.
• Customer data was over-collected and stored unencrypted at the provider.

The impact

Dealco B lost two weeks of sales and service revenue, faced customer complaints and an OEM review, and renegotiated its DMS contract with security and exit clauses.

The regulatory lens

• CERT-In Directions: incident reported within six hours by the provider and the dealer group.
• DPDP: customer and loan data exposure; breach intimation once provisions commence.
• OEM dealer standards: continuity and data-handling expectations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assure the platform	DMS and SaaS provider assessments, contract clauses, exit plans	B9
Test the portals	Dealer portal and integration security testing	B2
Keep selling	Dealer manual-operation playbooks and exercises	B10

Key lessons Assess the platforms your business runs on. Put security, notification and recovery in contracts. Keep dealers able to work on paper. Minimise and protect customer data.

Any VIN, any car, anywhere—one API call was all it took.

At a glance
Organisation	An EV manufacturer (“Evco C”) with a companion app and dealer portal
Threat	A shared back-end API allowing any authenticated user to bind a vehicle by VIN and issue locate, unlock and start commands
Why it is new	App and dealer APIs are the shortest path from the internet to the vehicle
Codec Networks services	API and app testing, connected-vehicle threat modelling, command monitoring (Bundles B2, B11, B7)

The scenario

Evco C's app and dealer portal used one back-end. A dealer function that transferred vehicle ownership did not check whether the caller was a dealer or owned the vehicle.

Researchers showed they could bind any vehicle to their own account using its VIN, then locate, unlock and start it. A criminal group had been using the same flaw to steal cars.

Evco C issued an emergency fix, notified customers and regulators and faced questions about its cyber security management system ahead of AIS 189.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Authorisation was not tested across app and dealer API functions.
• No threat model for vehicle binding and ownership transfer.
• Vehicle commands were not monitored for anomalies.
• No vulnerability disclosure channel or vehicle-incident playbook.

The impact

Evco C suffered vehicle thefts, customer and media backlash, regulator scrutiny and an accelerated AIS 189 programme.

The regulatory lens

• AIS 189 (CSMS): vehicle-reaching vulnerabilities, field monitoring and incident response as type-approval matters once notified.
• DPDP: vehicle location and owner data exposed.
• CERT-In Directions: incident reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the APIs	Authorisation testing across app, dealer and back-end APIs	B2
Model the vehicle	Connected-vehicle threat modelling and TARA	B11
Watch the commands	SOC monitoring of anomalous vehicle commands and bindings	B7

Key lessons Test authorisation on every vehicle-reaching API. Threat-model binding and ownership flows. Monitor vehicle commands. Run a disclosure programme and a vehicle-incident playbook.

Three thousand chargers went offline. The tariffs changed before anyone noticed.

At a glance
Organisation	A charge point operator (“Chargeco D”) running 3,000 public chargers
Threat	Attackers compromising the OCPP backend's admin interface, taking chargers offline, altering tariffs and accessing payment data
Why it is new	CPO back-ends concentrate control over thousands of chargers and payments
Codec Networks services	Backend and OCPP assessment, access hardening, monitoring (Bundles B1, B3, B7)

The scenario

Chargeco D's backend admin interface was exposed to the internet with password-only login shared by operations staff.

Attackers logged in, disabled chargers across several cities, changed tariffs and accessed payment records before demanding a ransom.

Drivers were stranded, DISCOM and payment partners escalated, and Chargeco D rebuilt its backend under regulatory and PCI scrutiny.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Admin interface exposed with shared passwords and no MFA.
• Charger credentials were identical across the fleet.
• Payment data stored beyond PCI DSS requirements.
• No monitoring of charger commands or tariff changes.

The impact

Chargeco D lost revenue and customers, faced PCI DSS and regulatory questions and re-architected its backend and charger fleet.

The regulatory lens

• PCI DSS: card payment environment security.
• Ministry of Power charging guidelines and BIS standards: operational and technical expectations for public charging.
• CERT-In Directions: incident reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the backend	OCPP backend, charger firmware and payment flow assessment	B1
Harden access	MFA, segmentation and unique charger credentials	B3
Watch the fleet	Monitoring of charger commands, tariffs and payments	B7

Key lessons Never expose backend admin without MFA. Give every charger unique credentials. Keep payment data to PCI DSS scope. Monitor commands and tariff changes.

The attackers knew where every truck was. Then they switched them off.

At a glance
Organisation	A fleet telematics provider (“Fleetco E”) serving logistics and ride-hailing customers
Threat	A leaked API key giving access to location, driver and trip data and to immobiliser commands
Why it is new	Fleet platforms hold sensitive data and can act on vehicles on the road
Codec Networks services	Cloud and API security, DPDP programme, monitoring (Bundles B2, B6, B7)

The scenario

A developer committed an API key to a public code repository. Attackers used it to pull location, driver and trip data for thousands of vehicles.

They then used the same key to send immobiliser commands to vehicles mid-shift, stopping deliveries and stranding drivers.

Fleetco E revoked keys, restored service and faced customer contract claims, driver complaints and a DPDP exposure.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Secrets were not managed; a key with broad rights was committed to code.
• Commands were not authorised per customer or rate-limited.
• Driver and location data were over-retained.
• No anomaly detection on data pulls or commands.

The impact

Fleetco E lost enterprise customers, handled a large personal data exposure and rebuilt its API, secrets and command architecture.

The regulatory lens

• DPDP: driver and location data; breach intimation once provisions commence.
• Customer contracts: security and notification obligations to fleet operators.
• CERT-In Directions: incident reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Secure the platform	Cloud and API security assessment, secrets management, command authorisation	B2
Protect the data	DPDP programme for driver and location data	B6
Watch for abuse	Monitoring of data access and vehicle commands	B7

Key lessons Manage secrets and least privilege. Authorise and rate-limit vehicle commands. Minimise and protect driver and location data. Detect anomalous data access.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com