Viral BAT-BMS Videos Raise EV Security Concerns in India

 Udaipur, July 2, 2026 | Technology Alert: A series of viral videos circulating across social media has sparked nationwide concern over the cybersecurity of Battery Management Systems (BMS) used in India's electric vehicles, particularly commercial e-rickshaws. The videos appear to demonstrate individuals using Bluetooth-enabled mobile applications to connect to nearby battery systems, allegedly causing vehicles to stop unexpectedly.

The incidents have generated widespread discussion among e-rickshaw drivers, fleet operators, battery manufacturers, cybersecurity professionals, and government agencies, highlighting the growing importance of securing connected battery technologies as India's electric mobility sector continues to expand.

According to multiple media reports, the issue is linked to certain Bluetooth-enabled Battery Management Systems that may be configured without adequate security controls. In some deployments, Bluetooth interfaces remain publicly discoverable, use default credentials, or lack authentication mechanisms, potentially allowing unauthorized users within Bluetooth range to establish a connection using compatible diagnostic applications.

It is important to note that this is not a malware campaign or an internet-based remote hacking attack. Instead, the reported issue involves local Bluetooth Low Energy (BLE) communication between a smartphone and a vulnerable Battery Management System. The risk depends on the specific battery hardware, firmware, and security configuration, meaning not every electric vehicle or BMS implementation is affected.

TraceX Labs Publishes Technical Security Advisory

In response to the growing public concern, TraceX Labs has released a comprehensive cybersecurity advisory titled:

"Unauthorized Over-the-Air Disruption of EV Battery Management Systems (BMS) via Unauthenticated Bluetooth Low Energy (BLE) Controls."

Prepared by the TraceX Labs IoT Security Research Team, the advisory provides an in-depth technical analysis of the reported issue, examines the underlying Bluetooth security weaknesses, assesses the potential impact on India's EV ecosystem, and outlines practical mitigation measures for manufacturers, battery assemblers, fleet operators, service technicians, regulators, and commercial e-rickshaw owners.

The report explains that the issue stems from insecure Bluetooth implementations rather than sophisticated cyberattacks. According to the advisory, some Battery Management Systems may be deployed with security weaknesses such as:

• Missing authentication for critical Bluetooth operations.
• Factory-default or publicly documented Bluetooth PINs.
• Open write permissions to battery control functions.
• Absence of access control lists or device whitelisting.
• Bluetooth interfaces that remain publicly discoverable after deployment.

If these security weaknesses are present, a nearby Bluetooth-enabled device running a compatible diagnostic application may be able to communicate with the Battery Management System without proper authorization.

Impact on India's EV Ecosystem

The advisory notes that Battery Management Systems play a critical role in monitoring lithium-ion battery health, balancing cells, managing charging and discharging, and protecting batteries against unsafe operating conditions.

Where vulnerable configurations exist, unauthorized interaction with the BMS could potentially interrupt battery discharge, creating operational and safety concerns for moving electric vehicles. The report highlights several possible impacts, including:

• Unexpected vehicle shutdowns during operation.
• Increased road safety risks for drivers and passengers.
• Service disruptions for commercial fleet operators.
• Financial losses due to operational downtime.
• Reduced public confidence in connected electric mobility technologies.

The advisory also points out that India's rapidly expanding e-rickshaw market, combined with the widespread use of low-cost battery assemblies and imported Bluetooth-enabled BMS components, makes cybersecurity an increasingly important consideration throughout the EV supply chain.

Immediate Mitigation Recommendations

To reduce potential exposure, TraceX Labs recommends that manufacturers, fleet operators, and vehicle owners immediately review the security configuration of Bluetooth-enabled Battery Management Systems.

Key recommendations include:

• Replace factory-default Bluetooth passwords with strong, unique credentials.
• Disable Bluetooth advertising when wireless monitoring is not required.
• Restrict Bluetooth pairing to authorized devices only.
• Apply manufacturer-issued firmware updates wherever available.
• Disconnect or remove external Bluetooth modules as a temporary mitigation if secure configuration is not supported.
• Perform regular security assessments of deployed Battery Management Systems.

For situations where firmware does not support password changes or Bluetooth security controls, the advisory also provides a temporary hardware mitigation procedure that involves physically disconnecting the Bluetooth communication module while preserving the battery's core protection functions. The report emphasizes that any hardware modification should only be performed by qualified technicians using appropriate electrical safety procedures.

Long-Term Industry Recommendations

Beyond immediate remediation, the TraceX Labs advisory encourages manufacturers to adopt secure-by-design principles for future Battery Management Systems. Recommended measures include mandatory cryptographic authentication, encrypted Bluetooth communications, secure pairing procedures, first-time device initialization requirements, and Bluetooth functionality disabled by default until securely configured.

The advisory also recommends strengthening automotive cybersecurity standards by incorporating mandatory wireless security testing, secure default configurations, and vulnerability disclosure requirements into future regulatory frameworks.

Complete Technical Report Available

The full TraceX Labs advisory includes:

• Executive Summary
• Technical Threat Analysis
• Bluetooth Attack Methodology
• India's EV Ecosystem Risk Assessment
• Temporary Hardware Mitigation Procedure
• Immediate Software Security Guidance
• Manufacturer Security Recommendations
• Regulatory and Policy Recommendations
• Supply Chain Vulnerability Assessment
• Long-Term Cybersecurity Framework

As connected technologies become increasingly common in electric vehicles, cybersecurity is emerging as a critical component of transportation safety. The TraceX Labs advisory aims to help manufacturers, regulators, fleet operators, and vehicle owners better understand the security implications of Bluetooth-enabled Battery Management Systems and implement practical measures to reduce risk across India's rapidly growing electric mobility ecosystem.