Cyberattack via EV Charging Navigation Could Trigger Local Power Outages, Study Warns

Researchers at The Hong Kong Polytechnic University (PolyU) have identified a new type of cross-domain cyberattack that could disrupt power systems without ever breaching the grid itself. Instead of attacking heavily guarded power communication networks, an attacker could manipulate electric vehicle charging navigation systems, steering large numbers of vehicles toward the same charging station within a short period. The resulting concentration of charging demand could, the study suggests, trigger local power outages or degrade the reliability of the grid.

The finding matters because most known cyberattacks on power systems must break into secure, dedicated communication networks, a difficult and costly undertaking. Driver-facing charging navigation systems, by contrast, are far less well protected, making them a more accessible entry point. The research shows that such an attack can originate entirely outside the distribution network and propagate through EV charging behaviour until it threatens the secure operation of the power grid.

Led by Prof. Bu Siqi, Associate Head (Research) and Professor in PolyU’s Department of Electrical and Electronic Engineering, the study examines risks arising from the deep integration of cyber-physical transportation systems (CPTSs) and cyber-physical power systems (CPPSs). CPTSs embed communication networks into transportation for traffic monitoring, routing and mobility management, while CPPSs incorporate them into power systems to support reliable monitoring, protection and control of generation, transmission and distribution. Their integration drives innovation but also creates vulnerabilities that attackers can exploit across system boundaries.

The technical core of the attack lies in what the researchers call sparse vector attacks on charging prices and traffic flow data. Rather than flooding a system with false information, an attacker injects a small number of carefully chosen false data points, enough to mislead the system’s decisions about where drivers are directed and what they are charged. Because the manipulated data is sparse, it may be harder to notice, yet it can still reshape charging behaviour at scale and expose increasingly interconnected infrastructure to new risk.

“This research highlights how a cyberattack originating in one system can spread to another,” Prof. Bu said. “By demonstrating the destructive potential of cross-domain attacks, we aim to raise public awareness and encourage stronger preventive measures.”

The study, published in IEEE Transactions on Transportation Electrification under the title “Design of Joint Cyberattacks on Electric Vehicle Charging via Pricing and Traffic Manipulation to Threaten Secure Operation of Power Systems,” goes beyond describing how such attacks could occur. It also proposes concrete defensive measures, including enhanced monitoring for abnormal price and traffic signals, stronger protection of communication links, and earlier detection of unusual recommendation patterns in EV charging navigation systems.

Because attacks of this kind could be highly destructive, their impact on cyber-physical power systems carries potentially serious consequences. The authors argue that clarifying both the mechanics of the attack and the harm it may cause is a necessary step toward defending integrated power and transportation networks before such scenarios materialise.

“As EVs become more popular, the connection between transportation and power systems will only grow closer, making cybersecurity increasingly vital,” Prof. Bu added. “Our research contributes to a safer charging environment, enabling more secure charging services and system integration, and supporting the adoption of EVs in Hong Kong, the Chinese Mainland and the world.”

Prof. Bu’s broader research focuses on power system stability, operation and economics, with emphasis on renewable energy integration, smart grid applications and transport electrification. His team also works on dynamic security risk assessment of renewable-rich power systems and on coordinating power and transport systems for more secure and resilient operations. The team has recently begun collaboration with Tianjin University, China Southern Power Grid and CLP Power under an NSFC/RGC Joint Research Scheme project on cyber-physical coordinated control and defence for grid-forming distributed energy resource clusters in Greater Bay Area megacities, work expected to address consumer concerns over voltage dips and other power quality issues.

The article was published on 1 February 2026, with the DOI 10.1109/TTE.2025.3636234.

Subject of Research: Cross-domain cyberattacks linking EV charging navigation manipulation to power grid security

Article Title: PolyU uncovers new cross-domain cyberattack risk targeting electric vehicle charging navigation systems, supporting secure operation of power systems

Article References: PolyU uncovers new cross-domain cyberattack risk targeting electric vehicle charging navigation systems, supporting secure operation of power systems. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: electric vehicles, cyberattack, power systems, charging navigation, false data injection, grid reliability, cyber-physical systems, transportation electrification, Hong Kong Polytechnic University, IEEE, PolyU, uncovers