Suspected Porsche Cyber Attack in Russia Leaves Cars Immobilised, Exposes Huge Potential Security Risks

Porsche’s Russian arm, Porsche Rusland LLC, has responded to reports from across the country that owners have been unable to turn their cars on. The company says it is investigating the issue, and has not ruled out a cyberattack. Additional details will be released by Porsche and parent company Volkswagen Group at the appropriate time. While Porsche has not sold its most recent tech-heavy cars in Russia since 2022 as part of an international response to the country’s military incursions into Ukraine, the issue has rendered hundreds of older cars there inoperable.

Porsche owners across Russia began reporting a few days ago that their vehicles suddenly refused to turn on, leaving them stranded with no information or solution. Local news outlets have published updates through the day as more reports came in. The affected cars seem to all have been manufactured in 2013 or later. The company’s satellite-based Vehicle Tracking System is the most likely cause of the failures.

Ignition failures are the most common problem, but some Porsche owners have also reported their cars shutting down automatically moments after being started, batteries being depleted rapidly, and alarm systems malfunctioning or locking them out entirely. In discussions online, affected owners initially suspected a faulty software update or a glitch in the anti-theft immobiliser feature. However, others raised the possibility that this was a coordinated, malicious attack. 

Some owners have reported that they were able to start their cars after removing or bypassing the factory-fitted immobiliser units, or by unplugging their car batteries for several hours. 

The incident raises questions about the level of disruption that is actually possible to inflict on populations dependent on cars, in the age of ubiquitous connectivity. Remotely disabling large numbers of cars, or sending them other instructions, could prove dangerous as well as disruptive.