Yes — a connected charger can be attacked in principle, the same way any networked device can. For a site operator, though, the practical question is not whether it is possible but whether you would notice. A compromise rarely announces itself; it shows up as activity that is not yours — sessions, users and settings in the platform that nobody on your team created.
Key Takeaways
- A connected charger can be attacked in principle; the operator’s skill is recognising it, not fearing it.
- The signs live in the platform: unknown sessions, users, cards, settings and unreconciled energy.
- Respond in order — preserve records, secure accounts, involve the platform and the maker, check the whole estate, then fix billing.
- No EVDANCE page states security features; update policy and account controls are written-confirmation items.
The Surfaces, Briefly
| Surface | What it exposes |
|---|---|
| User and operator accounts | Whoever holds the login can start sessions, change settings and see records |
| The management platform | Every charger on the account, its prices, users and billing data |
| The site network | The chargers’ connection to that platform — one more device on the site’s wiring |
Note what is not on the list: the charging safety functions. Connection checks, current signalling and fault cut-offs are local to the charger and the car, as how smart EV chargers work explains. The realistic harm from a compromised account is misuse — free or mis-billed charging, altered settings, exposed records — not a charger turned dangerous. Security expectations are becoming formal, too: Great Britain’s Smart Charge Points Regulations 2021 include security requirements for charge points sold there.
Signs Worth Investigating
- Sessions you do not recognise — charging at hours the site is closed, or under users nobody added.
- Accounts and cards you did not create — new app users, operator logins or RFID cards in the platform list.
- Settings that moved — prices, schedules or current limits different from what your team set.
- Energy that does not reconcile — metered energy and billed sessions drifting apart over days.
- Chargers behaving off-pattern — repeated unexplained offline periods or restarts. A sign to investigate, not proof on its own.
- Login and password-reset alerts from the platform that nobody requested.
Any one of these can have an innocent explanation — a colleague’s change, a faulty unit, a driver error. The pattern is the signal: several at once, or one that nobody can explain, is when to treat it as a security event.
First Steps, in Order
- Preserve the records first. Export or screenshot the session logs, user list and settings before changing anything — they are your evidence and your route to correcting bills.
- Secure the accounts. Change the operator passwords, sign out other sessions where the platform allows it, and remove any users or cards you do not recognise.
- Call the platform provider and the charger maker. Both keep their own logs; the platform side of the story — where logins came from — is theirs to tell.
- Check the whole estate. Every charger on the same account and platform, not just the one that looked wrong.
- Reconcile billing last. Correct driver bills only after the record is secured and the provider has confirmed what is genuine.
Asking About Security Before You Buy
EVDANCE product pages state connectivity facts — the EV-AC03201T states OCPP 1.6J and RFID, the EV-ACT3204E states RFID and app control — and state no security features: no encryption claim, no update policy, no account model. That is the normal state of a product page, and it makes the security questions written-confirmation items for any maker: how are updates delivered and for how long, what account controls does the platform offer, and what logging exists when something looks wrong. For EVDANCE projects those answers are arranged through the contact page. How the platform connection itself works is covered in OCPP explained for charge point operators.
Frequently Asked Questions
Would a hacked site put drivers in danger?
The safety functions that govern a session are local and electrical, in the charger and the car — an account intruder reaches accounts, settings and records. Treat compromise as a fraud and data problem, and respond to it promptly on that basis.
Should I take the chargers offline at the first suspicious sign?
Preserve the records first, then follow the platform provider’s guidance. Pulling everything offline immediately can destroy the session evidence you need and still leave the compromised account open.
Are unconnected chargers immune?
They have no network surface to attack — and no way to receive remote fixes, records or access control either. The choice is a trade-off, which is why the smart vs non-smart decision belongs with the site’s actual risks, not a label.
Related Reading
- OCPP Explained: Charge Point Operators, EV Charger Hardware
- How Do Smart EV Chargers Work?
- Smart vs Non-Smart EV Chargers: What Installers Actually Want
- EV Charger Certifications Explained: CE, UKCA, UL, ETL, CB and What Buyers Should Ask For
