Your electric vehicle has plenty of battery left, the dashboard looks perfectly normal, and yet the EV simply refuses to move. No flat tyre. No breakdown. No drained battery. Just an invisible digital switch that seems to have been flipped. It may sound unbelievable, but the recent controversy over e-rickshaws allegedly being stalled using battery-management apps has exposed a worrying reality: weak cybersecurity can leave some EVs vulnerable to remote tampering.
While the government has banned the apps in question, the bigger challenge lies in fixing the security loopholes that made such attacks possible in the first place.
What exactly happened?
The issue exploded after videos circulating on social media allegedly showed electric autorickshaws suddenly coming to a standstill in the middle of roads. Those clips soon drew attention to battery-monitoring apps such as BAT-BMS, Lossigy and Epoch-i-ion, which were allegedly being misused to remotely interfere with some EVs.
Originally designed to display battery health, charge levels, temperature and other technical details, the apps themselves weren’t necessarily the problem. In some cases, they were allegedly used to access the vulnerable battery management system (BMS) and switch off the battery’s discharge function. The battery would still have charge, but it would stop supplying power to the motor, bringing the autorickshaw to an abrupt halt.
The real loophole
It’s tempting to blame the apps, but that’s only half the story. Many affordable EV battery packs are sourced from third-party suppliers. In some cases, manufacturers reportedly shipped them with default bluetooth names, predictable passwords or almost no authentication. Some even lacked encrypted communication. This meant the BMS trusted almost anyone trying to connect.
It’s like you have basically left the front door unlocked with a neon sign saying “come on in”. Removing BAT-BMS from app stores closes one route. But if another developer creates a similar app tomorrow, the same weakness could be exploited again unless the battery itself is secured.
BMS: Brain behind batteries
The BMS is the brain of an EV’s battery. It constantly checks battery temperature, charging speed, voltage balance and overall health. It also decides when charging should stop or whether the battery should shut down to prevent overheating. Giving unrestricted access to that system is like handing strangers the admin password to your laptop. They may not physically touch your device, but they can still change critical settings.
Your EV at risk?
The short answer is yes, but don’t panic just yet. A lot depends on how “connected” your car is. Data shows remote features in Indian vehicles are shooting up. Remote battery management alone jumped from under 2 per cent to over 5 per cent of vehicles in just a few years.
Platforms like Tata iRA, Hyundai Bluelink, MG i-SMART and others are increasingly wired up with Internet-enabled, remote-access features. Many let you lock or unlock doors, check battery status, locate your vehicle or even cool the cabin before you get in. Super convenient? Absolutely. But every connected feature is also another digital doorway that needs protection.
Fortunately, mainstream carmakers usually employ stronger safeguards such as encrypted communication, multi-layer authentication, secure over-the-air (OTA) software updates and continuous security testing. Still, no connected vehicle gets a lifetime immunity certificate since software is constantly evolving.
Why the alarm bells
After the videos of rickshaws freezing mid-ride went viral, the government moved fast. Apple and Google were told to remove the three apps from their stores. A small sigh of relief. But banning the apps doesn’t fix the actual vulnerability. The underlying weak authentication and default settings in battery systems are still very much out there, waiting for the next app (or hacker) to exploit them. That is why the Centre has now asked automakers and component makers to run a full cybersecurity audit — checking battery communication interfaces, killing off weak authentication, removing unsecured defaults and locking down OTA update pathways.
There is also a bigger framework in the works, rolling out from October this year, pushing manufacturers to build proper cybersecurity management systems from the ground up, not as an afterthought.
Fixing the flaws
The biggest lesson from this episode is simple. Cybersecurity cannot be treated as optional. Manufacturers need to stop shipping battery systems with default passwords or unsecured bluetooth access.
Every battery should require strong authentication before allowing anyone to change settings. Software updates must be digitally verified so fake updates cannot be installed. Communication between mobile apps and the battery should always be encrypted. Vehicle owners should install only official apps and update firmware whenever available.
Smarter, safer EVs
EVs are the future no doubt, but “smart” only works if it’s also “secure”. The recent battery hack wasn’t simply about three apps disappearing from app stores. It exposed a larger truth: the weakest part of any connected system isn’t always the software people see, it is often the hidden code quietly running in the background.
As EVs become more connected, cybersecurity will be as essential as brakes, seatbelts and headlights. After all, nobody wants their ride to buffer in real life.
