Upstream’s 2026 Automotive Cybersecurity Report Finds Ransomware Incidents Doubled in 2025
Summary
Upstream analyzed 494 automotive and smart mobility cyber incidents in 2025, up 21% from 2024. Its 2026 report finds ransomware incidents doubled, backend systems dominated attack vectors, and remote attacks accounted for 92% of incidents.
Key points
- Upstream analyzed 494 publicly documented automotive and smart mobility incidents in 2025, a 21% increase over 2024; unreported or undiscovered incidents are excluded.
- Ransomware incidents rose from 108 in 2024 to 218 in 2025, accounting for 44% of recorded incidents.
- Backend systems featured in 67% of incidents, APIs in 18%, and EV charging infrastructure in 8%; incidents can involve multiple vectors.
- Remote attacks accounted for 92% of incidents, with long-range attacks representing 86% of that subset.
- Data or privacy breaches featured in 68% of incidents, business disruption in 34%, and vehicle manipulation or control in 22%.
- Nearly 61% of incidents had the potential to affect thousands to millions of mobility assets; these figures describe potential scale, not confirmed affected totals.
- The report identifies expanding AI and Model Context Protocol attack surfaces and recommends coordinated security monitoring across vehicles, APIs, cloud and backend infrastructure.
Article Details
- Publisher
- Upstream Security Ltd.
- Report Period
- 2025
- Scope
- Global Automotive and Smart Mobility cybersecurity incidents, automotive-related vulnerabilities, and deep and dark web activity.
- Sample Size
- 494 publicly documented incidents analyzed in 2025; deep and dark web findings are excluded from other chapters' incident statistics.
- Key Statistics
- Upstream analyzed 494 incidents in 2025, a 21% increase over 2024.
- Ransom-related activity accounted for 44% of recorded 2025 incidents; reported ransomware incident counts rose from 108 in 2024 to 218 in 2025.
- Data and privacy breaches affected 68% of 2025 incidents, compared with 60% in 2024; incidents can have multiple impacts.
- Remote attacks accounted for 92% of 2025 incidents; 86% of remote attacks were long-range.
- Backend systems were involved in 67% of 2025 incidents and APIs in 18%; incidents can involve multiple attack vectors.
- Recommendations
- Secure vehicle, API, cloud, and backend attack surfaces together, correlating telemetry with threat intelligence and proactive threat hunting.
- Implement network segmentation, supplier-side threat monitoring, and coordinated incident-response frameworks.
- Continuously monitor automotive-relevant vulnerabilities and deep and dark web activity, applying patches or configuration changes promptly.
- Maintain continuous Threat Analysis and Risk Assessment processes and reassess risks after software updates or connectivity changes.
- Include RF interfaces in risk assessments, supplier qualification, and in-service monitoring, supported by secure communications, encryption, and key management.
MITRE ATT&CK
T1078 · Valid AccountsReported intrusions used stolen credentials, including an allegation that third-party supplier credentials enabled access to a UK OEM's internal systems.T1110 · Brute ForceA researcher found that an OEM mobile application allowed unlimited OTP brute-force attempts.T1190 · Exploit Public-Facing ApplicationResearchers demonstrated exploitation of a zero-day SQL injection in a contractor's publicly exposed application to pivot into an OEM's telematics backend.T1486 · Data Encrypted for ImpactRansomware operations encrypted automotive IT and production systems to halt operations, including a reported attack on a European OEM.T1496 · Resource HijackingThe AutoDoS study demonstrated resource exhaustion against LLM services, increasing latency by more than 250 times.T1557 · Adversary-in-the-MiddleResearchers demonstrated spoofing of unauthenticated SLAC pairing messages to establish a man-in-the-middle position in EV charging communications.
CVE
CVE-2024-12054by a global automotive supplier. Tracked as CVE-2024-12054, the issue affectedCVE-2024-53012relying on automotive vehicle networks. Identified as CVE-2024-53012,CVE-2024-53031CVE-2024-53031, and CVE-2024-53032, these flaws could allow attackers toCVE-2024-53032CVE-2024-53031, and CVE-2024-53032, these flaws could allow attackers toCVE-2025-5484The issues, tracked as CVE-2025-5484 and CVE-2025-5485, affected all knownCVE-2025-5485The issues, tracked as CVE-2025-5484 and CVE-2025-5485, affected all knownCVE-2025-6543vulnerability tracked as CVE-2025-6543, forcing authorities to disconnect
People
Vendors
Products
AutoThreat®In 2025 alone, Upstream’s AutoThreat® researchers analyzed 494 new incidents, contributing to a continuously growing database of publicly documented cases dating back to 2010.AutoThreat® PROFor further insights, a more detailed analysis is exclusively available to AutoThreat® PRO customers.
Tools
Countries
Australiabus injection technique across Canada, Australia, and the UK. Attackers gainedCanadabus injection technique across Canada, Australia, and the UK. Attackers gainedChinaUK, Slovakia, China, and India. The campaign combined ransomware deploymentGermanyin Germany unintentionally exposed sensitive real-time and historical travel dataIndiaIn June 2025, an India-based ridesharing platform operating across India, Indonesia,Netherlandsspeed camera operations across major highways in the Netherlands wasRussiaIn December 2025, a German OEM’s vehicles in Russia were reportedlySlovakiaUK, Slovakia, China, and India. The campaign combined ransomware deploymentUnited Kingdom[^55]: Incident report: UK OEM cyber attack, September 2025.United States[^38]: Incident report: US motorcycle OEM data breach, January 2025.
Industries
Automotive# Global Automotive Cybersecurity Report 2026EV charging infrastructureEV Charging Infrastructure / Local GridsFleet managementTSP / Fleet ManagementInsuranceAutomotive insurance-related devices and applicationsPublic transportationITS and mobility IoT devices, such as public transportation systems, electronic loggingSmart MobilityThe Automotive and Smart Mobility ecosystem is once again at a pivotal moment.