Late February 2022
M11 motorway, Moscow to Saint Petersburg
A backdoor held by a parts supplier, according to the operator
Low. It rests on one party’s statement, and accounts conflict
In late February 2022, days after Russia invaded Ukraine, electric vehicle chargers along the M11 motorway stopped working. Photos and video showed them disabled and displaying political messages.
The case is often cited as charging infrastructure taken offline through a supplier link. It’s poorly documented, so it’s best read as a warning and not as a measured event.
What was reported
Rosseti, the Russian energy company operating the chargers, made the first public statement on Facebook. It said a Ukrainian parts supplier had disabled them through a backdoor in their control systems.
According to reports, Rosseti had bought the chargers through a Russian company, which had outsourced part of the production to a Ukrainian component supplier. Rosseti said it had isolated the chargers from its network.
What isn’t known
- How many chargers were affected, and for how long.
- How the access worked. Reports differ on whether it was an outside hack or built-in access.
- Whether the backdoor claim is accurate. We found no independent verification, and early requests for comment went unanswered.
It also happened in a war, so few operators will face the same motive. The useful part is the mechanism, which doesn’t depend on a war: someone upstream could reportedly reach chargers that the operator believed it controlled.
What operators can take from it
Map access beyond your direct suppliers
The company that sold these chargers wasn’t the company reported to hold access. Ask your suppliers which of their own component makers can reach your equipment.
Know how you’d cut off a supplier
Rosseti reportedly isolated the chargers from its network, with no date for their return. Decide in advance how you’d remove one party’s access while chargers keep working.
Plan for a supplier becoming unavailable
Suppliers can fail for commercial or political reasons, as well as technical ones. Check what your network does if a vendor service stops responding, and write down who can act.
Treat this as a NIS2 topic
Article 21 of NIS2 names supply chain security and business continuity as measures. A list of remote access paths is useful evidence for both. See question 7 of our supplier review.
