Cyberattack on Car Importer Highlights Broader Road Safety Risks

Car importer Colmobil announced to its business clients that it had experienced a significant information security incident, marking a first for the Israeli automotive industry. The company stated that its technology teams identified the event and were investigating its source, while also updating regulatory bodies. In response, the Ministry of Transport disconnected Colmobil from its computer systems responsible for vehicle registration, as reported by Calcalist. Customers of Mercedes, a brand imported by Colmobil, experienced delays in receiving new vehicles, with leasing company clients also reporting postponed deliveries. Experts involved in the incident suggested Colmobil was a victim of a ransomware attack, with demands made for an undisclosed sum, which sources indicate the company paid. Colmobil declined to comment on the nature of the attack or the ransom payment.

The incident at Colmobil, while seemingly resolved, highlights the vulnerability of car importers, which manage vast computer systems interacting with manufacturers, customs, and the Ministry of Transport. Beyond potential data breaches, the interconnectedness of modern vehicles with importer systems raises concerns about remote control and manipulation. Cyber experts have demonstrated the ability to disrupt vehicle systems, from GPS to cruise control, with potential for dangerous consequences. Hundreds of thousands of cars in Israel are linked to importer systems for updates and services, meaning a breach at an importer could affect vehicle performance and safety. This includes potential disruption to military vehicles and police cars that use importer services for charging, diagnostics, and updates.

Colmobil stated that it has overcome the information security event and that its systems are gradually returning to full operation, with all relevant parties informed. The company emphasized that the incident was not related to vehicle systems or manufacturers and that its vehicles do not have OTA (Over-the-Air) updates. The National Cyber Directorate confirmed its involvement with relevant parties in cyber incidents and stated it learns from such events to issue warnings and recommendations to strengthen defenses across the economy. The Ministry of Transport's response, disconnecting Colmobil, aimed to prevent further contagion, though the ministry only recently established protocols for such events, despite prior awareness of cyber risks in the automotive sector. These protocols require importers to submit cybersecurity policies, appoint a cybersecurity officer, and form a steering committee, alongside measures like monitoring for anomalies and mapping supplier risks. However, the guidelines may not fully address risks associated with Chinese data centers or the potential for importers to infect national systems or security vehicles.