A few days ago, an unprecedented event hit Israel’s automotive industry. Colmobil, the country’s largest vehicle importer, notified its business partners that it had suffered an information security incident.“A few hours ago, an information security incident was detected by the company’s technology team. The company had prepared for such an event; dedicated teams are currently investigating its source, and relevant regulatory authorities have been notified. The situation is being managed, and the company is working to resolve it as quickly as possible,” the notice stated.The seriousness of the incident became clearer when Calcalist reported that the Ministry of Transport had disconnected Colmobil from government computer systems used to register new vehicles. Over the following week, readers contacted Calcalist to report delays in services for Mercedes-Benz customers. Customers of leasing companies also said that deliveries of new vehicles had been postponed, with buyers asked to be patient while the situation was resolved.1 View gallery Trucks on the Coastal Highway – traffic jam (Yariv Katz)The disruption reflects how dependent vehicle importers have become on computerized systems. Even a seemingly routine task, such as replacing a car wheel, can involve multiple digital processes, from billing for the replacement and recording the part in the inventory system to processing payment. Colmobil worked to restore normal operations, but for several days it was forced to operate under different conditions, much like other large organizations that have suffered cyberattacks, including hospitals and technology companies.So who attacked Colmobil, and how did the attackers gain access?Cybersecurity experts familiar with the incident told Calcalist that Colmobil was targeted in a ransomware attack by a group named SETTRA. The attackers demanded a ransom, although the amount has not been disclosed. According to industry sources, Colmobil paid the ransom. The company has declined to comment on the nature of the attack or whether it made a payment.The incident raises questions that extend beyond one company. Vehicle importers operate extensive computer systems that connect them with manufacturers, customs authorities, the Ministry of Transport and payment-processing providers. Billions of shekels pass through these systems every year. The attack on Colmobil, described as the first incident of its kind involving an Israeli vehicle importer, highlights the need to examine how vulnerable this infrastructure is and what disruptions could mean for consumers and the wider economy.The risks go beyond the theft of credit card details or the loss of access to business records. Vehicle importers occupy an important position in a broader technological ecosystem that increasingly includes connected cars, remote diagnostics, software services and digital payments. Some vehicles can receive over-the-air (OTA) software updates, while connected services can support maintenance scheduling and other functions. Automakers are also exploring ways to enable drivers to purchase upgrades and additional services directly through their vehicles.These capabilities create new potential points of exposure, although the extent to which an importer’s systems can access or affect a vehicle depends on the manufacturer’s architecture and security controls. A cyberattack on an importer does not, by itself, establish that hackers can control vehicles remotely. It does, however, raise questions about the security of the digital connections linking importers, manufacturers, service centers and vehicles.Could hackers take control of a car remotely?For anyone who assumes that a vehicle cannot be manipulated through a cyberattack, security researchers have demonstrated otherwise. In controlled research settings, hackers have shown that vulnerabilities in vehicle electronics and connected systems can affect functions ranging from communications to vehicle operation. Such demonstrations have generally taken place under specific conditions and should not be confused with evidence that an attacker could remotely take control of any vehicle through an importer’s network.In a modern connected vehicle, a compromised system could potentially create risks beyond the loss of customer information. Depending on the vehicle’s design and the vulnerability involved, an attack could interfere with software, communications or certain vehicle functions. A scenario in which a hacker remotely forces a car to accelerate to 200 km/h, however, would require a specific technical pathway and should not be treated as a demonstrated consequence of the Colmobil incident.The scale of the connected-vehicle market makes these questions increasingly important. Hundreds of thousands of vehicles in Israel rely on digital systems for at least some services, diagnostics or software-related functions. OTA updates are one example. In supported models, a manufacturer can send software updates without requiring the owner to visit a service center. An update may improve software, introduce new functions or change vehicle performance.The process varies by manufacturer and model, and the involvement of a local importer is not necessarily the same in every case. Nevertheless, any digital infrastructure that mediates communications between manufacturers and vehicles must be protected against unauthorized access and manipulation. A compromised system could disrupt the delivery of legitimate updates or create other risks, depending on the architecture and security measures in place.The potential implications also extend to public safety and national security. Security forces use modern vehicles that require servicing, diagnostics and, in some cases, software updates. Vehicles may also be connected to charging infrastructure or equipped with OBD, or On-Board Diagnostics, ports that technicians use to access diagnostic information. These connections create a need to assess whether cyber vulnerabilities could affect vehicles used by the military, police or other public bodies.In an extreme scenario, a cyberattack that reached the relevant vehicle systems could disrupt the operation of a police vehicle, an IDF bus or a transporter. Such outcomes are not established in Colmobil’s case, and the feasibility of any particular attack would depend on the systems involved. The broader concern is that the automotive sector’s digital dependencies could create risks that extend beyond a single importer’s commercial operations.There is also a financial and administrative dimension. Vehicle importers collect purchase taxes on behalf of the state and process large volumes of transactions related to importing and registering vehicles. A major disruption to an importer’s systems could therefore affect tax payments, licensing, settlements and vehicle deliveries, even without any compromise of a vehicle’s own electronics.Colmobil declined to comment on the technical details of the incident. According to sources familiar with the attack, the perpetrators demanded payment and demonstrated that they could disrupt the company’s systems. The available information does not establish that the attackers attempted to interfere with vehicles on the road.Colmobil described the incident as a temporary disruption and said it had returned to full operation. The episode nevertheless showed how a cyberattack against a business’s computer systems can have consequences for customers and the wider industry.Transport Ministry rules under scrutinyThe Ministry of Transport responded to the Colmobil incident by disconnecting the importer from its computer systems, a precaution intended to prevent the threat from spreading. The episode also drew attention to the ministry’s framework for addressing cybersecurity risks among vehicle importers.The ministry began addressing the issue more formally only in recent months, despite growing awareness across the automotive industry that cyberattacks could disrupt its operations. Its guidance requires importers to submit an organizational cybersecurity policy and review it annually in light of evolving threats and their severity.Importers must also appoint a cybersecurity officer, either internally or through an external provider, and establish a cybersecurity steering committee that meets twice a year. Among its responsibilities is determining the cybersecurity training provided to employees, including management.The ministry’s framework also identifies risks at the vehicle level. These include threats to vehicle safety; interference with the integrity or reliability of data exchanged between importers and service systems; disruptions to the availability of information and services, including those related to electric-vehicle charging; and data leaks or privacy violations.The recommended preventive measures include tracking information-security updates across the distribution network, monitoring and reporting anomalous events in vehicles and importer systems, and maintaining the ability to respond to cybersecurity incidents involving vehicles before notifying the ministry. Importers are also expected to assess external suppliers according to the cybersecurity risks they pose and provide customers with information about potential threats.Questions remain about whether the framework adequately addresses the full range of risks. One concern is the role of manufacturers’ data infrastructure located in China and how it is secured, accessed and governed. Another is whether the requirements sufficiently account for scenarios in which an attack on an importer could affect connected systems beyond the company itself, including infrastructure used by the state or vehicles operated by security forces.These are questions for regulators, manufacturers and importers to address through technical assessments rather than assumptions about what a particular attacker could achieve. The Colmobil incident has made the need for that scrutiny more immediate.The attack may have been resolved, but the broader challenge remains. If a future incident were to disrupt vehicle services on a larger scale, or compromise systems with a direct connection to vehicle operation or public infrastructure, disconnecting an importer from government systems and asking customers to wait for delayed deliveries might not be enough. The consequences would depend on the systems affected, the speed of the response and the effectiveness of safeguards already in place.Colmobil said it had resolved the cybersecurity incident and was providing full service to customers, including vehicle maintenance, software updates and support at service centers. The company said its systems had been gradually restored and that all systems were expected to be fully operational by Sunday. It added that all relevant parties had been notified.The company also said the incident was unrelated to the vehicles’ own systems or to the manufacturers, and that its vehicles do not support over-the-air (OTA) updates.The National Cyber Directorate said: “The National Cyber Directorate engages with relevant stakeholders during cyber incidents, as is the case here. While specific details of the incident cannot be disclosed, the Directorate derives lessons and broader insights from such events. It then disseminates alerts, recommendations, and guidelines to entities across the economy, as necessary, to strengthen defenses and mitigate the risk of further attacks against the Israeli economy.”
——————————————————–
Click Here For The Original Source.
