EV Charging Security: The OCPP Gaps Most Stations Still Haven't Fixed
EV charging stations talk to their backend over OCPP, not Modbus — a different protocol with its own attack surface most stations haven't secured yet.
EV Charging Security: The OCPP Gaps Most Stations Still Haven't Fixed
EV charging stations don't speak the same protocol as solar inverters. Solar and battery storage talk mostly in Modbus, but EV charging stations talk to their backend over OCPP (Open Charge Point Protocol) — a different standard, different attack surface, different defenses entirely. If your organization runs both solar and EV charging infrastructure and treats "OT security" as one uniform problem, that assumption is itself a gap.
This piece zooms in on the EV charging side specifically: what's actually wrong with OCPP, and why so many stations are still exposed.
What OCPP is, and why old gaps are still open
OCPP is the standard protocol charging stations use to talk to their backend — managing charging sessions, payment, and device status. The problem is that the older OCPP 1.6 spec is still running widely, according to the Open Charge Alliance that maintains the standard, and it wasn't designed with security as a first-class concern — security was one of the things OCPP 2.0.1 added.
The recurring flaws showing up across research and security reports:
- WebSocket endpoints lacking proper authentication — opening the door to station impersonation or feeding fake data straight into the backend
- Weak TLS implementations — enabling Man-in-the-Middle attacks that intercept and alter data in transit
- Loose session management — no real limit on how often a station can talk to the backend, making brute-force or replay attacks easier
None of this is theoretical. Documented consequences range from denial-of-service to firmware theft to data poisoning the backend has no way to detect as fake.
Real incidents that have already happened
Ignitis ON (a European EV charging service) — February 2024: A group calling itself "Just Evil" claimed to have breached the app's control panel, cutting off real users' access to their charging stations and posting video as proof. Ignitis's own report confirms a breach affecting more than 20,000 customers and some employees — names, email/postal addresses, plate numbers, and RFID token codes were exposed, though Ignitis says payment details and personal access codes stayed secure. The attacker's further claims — leaked employee data, access keys, and charging-station firmware, plus a ransom demand — are reported by security researchers but not independently confirmed by Ignitis itself.
This case shares a pattern with other OT/OCPP incidents: it didn't require nation-state-level sophistication, and the weaknesses involved were the same class of well-known gaps covered above — not a novel technique. See more real incidents across both solar and EV charging in How Many Times Have Solar and EV Charging Actually Been Hacked? (a couple of other EV/solar incidents circulating in industry write-ups didn't hold up to source-checking closely enough to include here — we'd rather cite fewer, verified cases than pad the list).
What to monitor specifically for EV charging
- Unusual patterns in backend communication — sessions opening at an abnormal frequency, or a "familiar" station suddenly sending data from a new IP or pattern never seen before
- Payment transaction anomalies — volume or frequency that deviates from a given station's normal baseline
- Firmware or config changes outside the normal maintenance window — updates that didn't come through the expected channel
How zcrOT fits in
zcrOT watches OT device communication passively — never sitting inline in a way that could interrupt an active charging session — but flags abnormal traffic and telemetry signals before they turn into an incident like the one above. It's the same principle covered for the solar side in OT Security for Solar and EV Charging Infrastructure — looking at network-level traffic patterns (protocol, port, session behavior) for the charging station, not parsed at the OCPP application layer specifically.
If you manage EV charging infrastructure and want to know whether your current traffic already shows signals like these, check the zcrOT pricing.
Get in touch
Want to know if the EV charging stations you manage carry this kind of risk? Our team offers a free consultation.
Sources: CyberInsider — Security Flaws Uncovered in EV Charging Infrastructure OCPP Backends, AltEnergyMag — How Cyber Attackers Hack EV Charging Infrastructure, Ignitis 2024 Annual Report