BSI charging infrastructure report: the IT gaps in OCPP and ISO 15118

A first BSI picture for charging stations

For the first time there is an official security picture for charging infrastructure. On 7 May 2026 the BSI, together with the Federal Ministry of Transport, published its report on the IT security of public charging infrastructure. It assesses systematically how well networked charge points are protected against cyberattacks, and sums up the result in three words: considerable room for improvement.

The timing is no accident. In April 2026 Germany passed 200,000 public charging points for the first time, and every new point is another networked computer in public space. That is exactly what makes the BSI nervous: networked charge points are a potential entry point for serious attacks. For this the report looks at the central protocols OCPP and ISO 15118, plus testing activities and legal requirements down to the AFIR regulation.

Until now operators had to piece their own security picture together. Now there is a shared reference on the table that municipal utilities, charge point operators and their service providers can align to. That is the real value of the report: not the headline, but the yardstick.

Where the report sees weaknesses

The standards are not the problem. OCPP and ISO 15118 offer modern cryptography and transport encryption, and the report says so plainly. The problem is that these protections often stay optional in practice, or are switched off entirely so older stations can still take part. The technology is ready. It is only half used.

It shows most clearly at OCPP, the protocol between charge point and backend. The report lists typical weaknesses in OCPP communication, in the authentication of charging cards and apps, and in remote maintenance over unsecured connections. The core is transport encryption: TLS is increasingly used, but not consistently mandatory. Where it is missing, an attacker reads along.

With ISO 15118 and Plug and Charge the risk sits elsewhere. Here complex certificate chains and distributed responsibilities create convenience, but also dependence on a few central trust anchors. If one such anchor is compromised, the consequences reach across the whole charging infrastructure. That is why the report singles out certificate management as especially critical.

The blind spot, though, is the backend. Billing and load management were mostly left out of earlier analyses, yet the real control sits there. The report finds default credentials, missing encryption and software gaps that could, in the worst case, take many stations offline at once. The BSI describes the protection level of many stations vividly as comparable to a computer from the 1990s. Overstated, yes. But the point lands.

The threat scenarios

An attack on a charging station rarely hits just one driver. Because many charge points hang off shared control and the same backend services, a single access can reach a whole fleet. That is the uncomfortable part of the report.

The scenarios range from manipulated charging sessions and billing fraud through leaks of payment and customer data to coordinated shutdown attacks on entire charge park clusters. The BSI describes how whole regions could be cut off from charging infrastructure for a time. And it goes further: effects on the stability of the power grids are explicitly not ruled out. No wonder, since as of 1 June 2026 around 8.87 gigawatts of simultaneous charging power sat in the system.

How real this is shows in independent research. A relay attack on ISO 15118 Plug and Charge documented in late 2025 showed that a vehicle cannot reliably verify the identity of the charging station, so a stranger's car pays the bill. It is not the end of the world. But it is proof that the attack surface is not theoretical.

• Manipulated charging sessions and billing fraud at the individual station.
• Leaks of payment and customer data through insecure apps or backends.
• Coordinated shutdown attacks that hit entire charge park clusters at once.
• Grid effects, because controllable charging power in the gigawatt range hangs off the same system.

German and EU perspective

The report meets a legal frame that is tightening right now. With the NIS2 transposition, charge point operators become part of regulated critical infrastructure. That is more than a label: they have to run risk management to the state of the art, secure their supply chain and report incidents quickly. And they have to know which software even runs on their stations.

In parallel the IT security catalog under Section 5c EnWG applies, which the Bundesnetzagentur has already adapted to the new situation. Digital energy services move into the same set of duties as grid and plant operators. If you want to orient yourself here, the details on the catalog sit in the piece on the IT security catalog 5c EnWG, and the overarching network code in the piece on the NCCS cybersecurity obligations.

The report names the real problem itself: the requirements come today from many laws and regulations, of which many are not yet binding. This fragmentation is why existing technology does not reach the field everywhere. Affected is not only the station operator, but the whole chain: backend providers, mobility service providers, roaming platforms and the makers of the charging hardware. The data duties of that chain are covered in the piece on DATEX II in charging infrastructure.

Challenges and risks

The core question is not the technology. It is the obligation. The protections have long sat in the standards, but without a duty, an audit and proof, their rollout stays voluntary. And voluntary loses against cost pressure.

Operators sit in a genuine bind. Binding requirements meet legacy stations that cannot be retrofitted without effort, and backward compatibility that nobody wants to simply cut. On top comes a fragmented testing setup: authorities, testing bodies and certifiers hold overlapping responsibilities, which makes checks slow and expensive.

For all the urgency, a sober look helps. The image of a 1990s computer creates pressure to act, but it is a rhetorical sharpening, not a measured metric. Large, publicly documented outages from attacks on German charging infrastructure are not on record so far. The scenarios are meant as prevention, not as hindsight. That does not make them less important, but it helps to place them right: the report is a warning with lead time, not a damage log.

What operators should do now

The report offers a clear list of priorities, and the good part is that the most important steps cost more discipline than money. Whoever encrypts OCPP, authenticates cleanly and keeps an emergency plan covers the most common gaps and meets core NIS2 duties at the same time.

• Make TLS mandatory for OCPP: turn on transport encryption for every OCPP connection between station and backend and do not leave it optional, because that is exactly where an attacker reads along otherwise.
• Authenticate uniquely and remove default passwords: give every charge point and every backend access a unique identity, remove default credentials consistently and secure remote maintenance over encrypted channels.
• Test regularly and disclose weaknesses: schedule recurring penetration tests and set up a process for coordinated disclosure, so reported gaps do not vanish in an inbox.
• Standardize certificates and incident response: bring certificate management for Plug and Charge into orderly, standardized processes and keep an incident response plan ready that has actually been rehearsed.
• Build a software inventory of the fleet: keep a current list of which software and firmware runs on which station, because without that overview the NIS2 reporting duties cannot be met in an emergency.

Further reading

Frequently asked questions