Connected vehicles are no longer just a feat of technological progress; they have become key targets for cybercriminals aiming to extract large sums through ransomware attacks. As automakers adopt more sophisticated AI and cloud-based tools, attackers are adjusting their tactics, reaching deep into supply chains and even individual vehicles. Recent industry reports underline that operational continuity and functional safety now hinge as much on digital security as on traditional engineering. These developments not only challenge automakers but also press regulators and insurers to rethink systemic risks tied to digital mobility platforms.
Earlier reports on automotive cybersecurity mostly highlighted vulnerabilities isolated to data privacy, infotainment hacks, or targeted breaches of individual vehicle systems. While such incidents caused alarm, their scale was relatively limited, and operational disruptions were often localized. Now, threat actors have shifted focus, orchestrating wider attacks that cause industry-wide disruptions and financial losses. Especially striking is the speed at which threat actors adapted their strategies after AI tools and cloud platforms became common in vehicles, with a strong pivot from small-scale breaches to ransomware operations locking large fleets and paralyzing manufacturers.
Why Are Vehicles More Vulnerable Now?
A rapid surge in AI adoption, particularly Physical AI, has increased the attack surface for the automotive industry by connecting more vehicle subsystems to the internet and external applications. The 2026 Global Automotive and Smart Mobility Cybersecurity Report by Upstream explains this shift with concrete data: 71% of known cyber incidents in 2025 were attributed to organized criminal groups, up from 65% the prior year. The interconnectedness, especially through APIs and over-the-air updates, now makes backend servers critical weak points. These weaknesses open up new points for attackers to exploit, resulting in more frequent and severe incidents that impact not just vehicles, but the entire mobility and supply chain ecosystem.
How Did Ransomware Attacks Escalate?
Ransomware attacks on connected auto platforms nearly doubled over the previous year, accounting for 44% of all recorded cybersecurity incidents in 2025. Upstream’s analysis highlights that attackers no longer focus exclusively on IT systems; they now leverage remote command and vehicle control, locking owners out and even demanding payment for restored access. One of the most severe cases involved a major European carmaker, where an attack disabled both enterprise and production systems for weeks and had measurable downstream effects, including a visible reduction in national GDP and government intervention to support the affected business.
What Are the Broader Industrial and Business Risks?
The increasing reliance on digital channels in the automotive sector means that remote cyberattacks can propagate swiftly, reaching vast numbers of vehicles and operations. Upstream reports that 92% of incidents in 2025 were remotely executed, with 86% requiring no physical proximity to the vehicle. This trend amplifies the importance of robust cybersecurity solutions, such as extended detection and response (XDR) platforms, as traditional perimeter defenses often fall short. Yoav Levy, Upstream’s Co-Founder and CEO, noted:
“The automotive industry is an early adopter of Physical AI, and as AI capabilities rapidly expand across markets, it now serves as the reference architecture for safety-critical, highly connected systems.”
He further stated:
“AI is also enabling attackers to move faster, at greater scale, and with more automation while the industry is still relying on security models built for a far more static world.”
Systemic risk no longer remains confined to isolated hacking events; instead, business operations and even critical infrastructure feel the effects when mobility platforms come under cyberattack. Telematics and cloud-based architectures were central in 67% of incidents, and the majority involved breaches that could impact thousands—if not millions—of mobility assets simultaneously. Industry observers suggest that as insurance policies and regulatory frameworks adapt, they must now address aggregate risks rather than merely the sum of individual vulnerabilities.
Looking ahead, automotive manufacturers and mobility service providers need to reconsider cybersecurity as an integral operational priority. Regular patch management, security audits of API connections, and investment in next-generation detection and response platforms are becoming mandatory safeguards. Individual consumers may not control industry standards, yet awareness about potential vulnerabilities and manufacturer security policies can guide safer purchase and usage decisions. Understanding that digital threats now extend to vehicle control underscores the importance of cybersecurity literacy not just for companies, but for every driver in a connected world.
