Chinese EV charger maker ELECQ is warning customers that their personal details may have been stolen in a ransomware attack that encrypted and copied user data from its cloud systems, with the breach discovered on March 7 when the company detected unusual activity on its AWS platform. If you're one of those customers, your home address is now in the hands of criminals. Not a pleasant thought while you're trying to go about electrifying your daily commute.
ELECQ says the compromised data is limited to names, email addresses, phone numbers, and home addresses.The company insists no financial data such as payment records or credit card information was involved, and stressed that the attack did not affect the charging devices themselves, which it says remain fully secure and operational. That's something, but contact details paired with home addresses are a goldmine for social engineering scams and physical threats.Contact details and addresses may not sound especially dramatic, but in the wrong hands, they can make social engineering scams far more convincing.
The company says it kicked off its incident response process as soon as the suspicious activity was spotted, taking affected servers offline and starting the job of restoring systems from backups. Since then, ELECQ says it has tightened up parts of its infrastructure, including shutting down remote access services such as SSH and Telnet and beefing up encryption across its network. Standard damage control, nothing you wouldn't expect. But here's the problem: the fact that ELECQ had those services exposed in the first place says something troubling about how the EV charging industry built its security.
Several important details remain unclear. ELECQ has not said how many individuals may have been affected by the breach, whether it has identified the attackers responsible, or whether a ransom demand was received. That's a gap that matters. Without knowing the scale of the breach or whether ransom was paid, we can't fully assess the damage or the incentives at work.
The ELECQ incident is not an isolated security hiccup.Attacks on electric vehicle chargers account for 6% of all incidents in the automotive and smart mobility space, compared to 4% in 2023. More broadly, ransomware targeting the automotive sector has exploded.Ransomware attacks increased significantly in 2025, with 44% of attacks being ransomware-related, more than double the volume than in 2024. Not all of that is charger-focused, but the trend tells you where criminal organisations see the weak spots.
Why target chargers? Because the people building them have prioritised speed and cost over security.The Idaho National Laboratory recently found that every charger it examined was running outdated versions of Linux, had unnecessary services, and allowed many services to run as root. That's basic stuff. Root permissions on unnecessary services is a beginner's mistake.Current charging stations are operated as build-and-forget devices that are highly exposed and network connected, with cyber and physical vulnerabilities. When the market is racing to roll out infrastructure faster than anyone can build defensively, security becomes an afterthought.
There's a genuine case for caution here.A vulnerability in an EV charging station's management console can expose customer identity, billing metadata, and charging session data across hundreds of thousands of users. Scale the damage: if a major charging network went down during an emergency when people needed to evacuate, the consequences wouldn't just be inconvenience. Ransomware isn't just about stealing data anymore; it's about operational disruption at scale.
Yet there's another side to the story. The industry faces a coordination problem that no single company can solve.As one cybersecurity expert put it, budget-oriented companies don't always choose the most cyber-secure implementations, but the government can directly support the industry by providing fixes, advisories, standards, and best practices. EV charging infrastructure sits at the intersection of energy regulation, automotive standards, and telecommunications security, with oversight split among multiple agencies and jurisdictions. No one is clearly accountable.
Reasonable people disagree on how much regulation is needed versus how much the market will sort out for itself. A heavy-handed mandate for SOC2 certification might slow down infrastructure rollout when Australia needs more chargers, not fewer. But leaving security entirely to companies racing to capture market share is leaving the door wide open for the next ELECQ.
What's clear is this: as EV adoption accelerates and charging becomes critical infrastructure, the security of these systems matters to everyone plugged in. ELECQ's breach is a warning. The question is whether the industry and its regulators will heed it before something worse happens.