During the third quarter the vehicle, not the office, was where attackers aimed. Between July 1 and September 30, VicOne’s CyberThreat Research Lab recorded 400 automotive cybersecurity incidents, 16.1% below the 477 logged in the preceding three months.
The domain breakdown carries the headline shift. At 174 incidents, in-vehicle systems edged past enterprise IT at 149. That ranking ran the other way in the second quarter, when enterprise cases hit 230 against 168 inside the vehicle. A rise to 24 from 18 was seen in connected backend incidents, while charging-related cases slipped to 23 from 28.
Busiest region again was the Americas, at 184 incidents, down from 245. The sharpest move came from Asia, up 36.8% to 93 cases and nearly level with Europe’s 95.
Supply chains kept absorbing ransomware. Ninety-seven incidents were counted by the lab. Dealers and retailers led at 24, suppliers came close behind at 23, and logistics and original equipment makers tied at 13 each. Most claims belonged to Qilin, at 11, with The Gentlemen on seven and Settra on four. Volume eased month by month, with totals of 39 for July, 35 for August and 23 for September.
Web facing bugs gave way to other weaknesses. Nineteen findings came from command injection (CWE-78); stack-based buffer overflow and missing authentication added 13 apiece.
Several cases already on the record are named in the report. Unauthenticated interfaces on the My Eicher fleet platform allowed account takeover, Bendix EC80 brake controllers could be reached through J2497/PLC4TRUCKS signaling, and relay attacks against ISO 15118 Plug and Charge were demonstrated.
At three layers AI surfaced, from vehicle perception through manufacturing systems to enterprise tooling, which makes agent permissions part of the automotive risk calculation.
Only what VicOne monitors is covered, so the totals are a floor rather than a census.
