Picture this. You’re doing 100km/h on the motorway when the horn starts blaring, the wipers start flapping and the steering wheel jerks in your hands. You haven’t touched a thing. Somebody else has – and they could be miles away.
It sounds like the plot of a Hollywood thriller. It isn’t. Security researchers have already shown they can do exactly that to a real electric car sold in Ireland. And the same kind of weakness has forced regulators to order fixes for 465,000 pacemakers and to tell diabetics to swap out insulin pumps that someone nearby could take control of.
This comes as Ireland is battered by what the Taoiseach calls near-constant cyber attacks. Last week hackers hit the fridges in 13 SuperValu stores. In March a global attack shut down a medical-technology giant with a major base in Cork. Here’s what’s really possible, what has already happened, and what you can do to protect yourself.
Can hackers really take over your car?
Yes. A modern car is basically a smartphone on wheels. It’s connected to the internet, it talks Bluetooth to your phone, and it gets software updates over the air. Every one of those connections is a door, and researchers keep finding them unlocked.
The Nissan Leaf that could be steered remotely
At the Black Hat Asia security conference, researchers from the firm PCAutomotive showed how they broke into a 2020 Nissan Leaf, one of the most popular electric cars on Irish roads. According to SecurityWeek, they got in through the car’s Bluetooth infotainment system and then set up a hidden mobile connection so they could come back whenever they liked.
Once inside, they could track where the car was, take screenshots of the dashboard screen and secretly record conversations inside the car. They could also work the doors, windows, mirrors, lights, horn and wipers, and even move the steering wheel, including while the car was being driven. Nissan confirmed the findings but did not say exactly how it had fixed them.
Millions of Kias unlocked with just a number plate
In 2024 a team led by security researcher Sam Curry found a flaw in a Kia web portal that let them take over the connected features of almost any Kia made after 2013. SecurityWeek reported that all they needed was the car’s number plate. With that they could locate the car, unlock it and start the engine in under 30 seconds. They could also pull up the owner’s name and phone number. The owner would never have known. Kia fixed the flaw after the researchers warned it, and there is no evidence anyone else used it.
76 brand-new car hacks in three days
In January this year the world’s top hackers met in Tokyo for Pwn2Own Automotive, a contest where carmakers pay out for security holes. In three days they found 76 previously unknown flaws in Tesla’s infotainment system, car stereos and EV chargers, and took home more than $1 million, The Register reported. One team even got the classic video game Doom running on a charging point.
Hackers inside your heart: medical devices at risk
If a hacked car is frightening, a hacked body is worse. Pacemakers, insulin pumps and hospital monitors are now wireless too, so doctors can check and adjust them without surgery. That convenience comes with a risk.
465,000 pacemakers needed an emergency fix
In 2017 the US Food and Drug Administration (FDA) ordered a security update for six models of Abbott pacemakers, formerly made by St. Jude Medical. NBC reported that the flaws could let a hacker take over the device that keeps a patient’s heart beating. Security experts warned an attacker could run the battery down or change the heart’s pacing. About 465,000 patients in the US had to visit their doctor to have the software patched. The FDA said there were no reports of anyone actually doing it.
Insulin pumps that could be hijacked
In 2019 the FDA warned that some Medtronic MiniMed insulin pumps could be wirelessly connected to by an unauthorised person nearby, who could then change the settings and control how much insulin was delivered, Becker’s Hospital Review reported. Too much insulin can kill. The flaw couldn’t be patched, so patients were told to talk to their doctor about switching to a different model. Again, no patient harm was confirmed.
A hidden backdoor in hospital monitors
In January 2025, US cyber agency CISA and the FDA told hospitals to unplug the Contec CMS8000, a patient monitor that tracks heart rate and blood oxygen. The Record reported that the agencies found a hidden function in its software that connected to a hard-coded internet address and could download and run files, and that it sent patient data out. Infosecurity Magazine reported the monitor was used in hospitals in the US and the EU. One security firm argued it may have been a badly designed feature rather than a deliberate backdoor, but the advice was the same: get it off the network.
Cyber attacks in Ireland: it’s already happening here
Ireland knows how bad this gets. In May 2021 the Conti ransomware gang crippled the HSE’s entire IT system, sending hospitals back to pen and paper for weeks. This June, Midlands Regional Hospital Tullamore was fined €300,000 by the Data Protection Commission after a ransomware attack on patient data.
In March, the Cork base of US medical-technology firm Stryker was hit by a global attack, RTÉ reported. An Iran-linked group called Handala claimed it wiped more than 200,000 systems and shut down Stryker offices in 79 countries, though those claims weren’t independently verified.
And this month, refrigeration systems in 13 SuperValu stores were hit. Speaking afterwards, Taoiseach Micheál Martin said attacks now come “almost on a weekly, daily basis” and warned that AI-powered hacking is “more dangerous than ever before”.
“Very, very worrying.” – Taoiseach Micheál Martin on the wave of cyber attacks hitting Ireland
So should you be scared?
You should be alert, not panicked. Every car and medical device hack above was found by “white hat” researchers who reported it so it could be fixed. There’s no confirmed case of a criminal crashing a car or harming a patient this way.
But here’s what should keep you up at night: the good guys don’t always find them first. The same skills that won $1 million in Tokyo are for sale on the dark web, and the gangs who took down the HSE and attacked SuperValu’s fridges are already going after machines in the physical world, not just data. Your car and the device in your chest are machines too.
How to protect yourself from car and medical device hacking
If you drive a connected or electric car:
- Install software updates as soon as your car or its app offers them. They often fix security holes.
- Protect your car’s app with a strong, unique password and turn on two-factor authentication.
- Remove old phones from the car’s Bluetooth list, and unlink the app if you sell the car.
- Don’t plug random USB sticks or cheap unbranded gadgets into your car.
If you or a family member has a pacemaker, insulin pump or other connected device:
- Don’t switch it off or stop using it. The risk of going without your device is far greater than the risk of a hack.
- Ask your consultant or clinic whether your model has any security updates due.
- Report anything unusual, like settings changing on their own or unexpected battery drain, straight away.
- Only use the official app and accessories from the manufacturer.
For general advice on staying safe online, the National Cyber Security Centre publishes guidance for the public. And if a power cut is your bigger worry this winter, read our guide to what an EirGrid alert really means and what to do if your power goes.
What happens next
New EU rules already require carmakers to manage cyber security across a vehicle’s life, and regulators in the US and Europe now demand that medical device makers build in security from the start. But as long as more of our lives run on software, the hackers will keep looking for a way in. The question isn’t whether someone will try to hack your car. It’s whether the people building it got there first.
Sources: SecurityWeek (Nissan Leaf), SecurityWeek (Kia), The Register, NBC, Becker’s Hospital Review, The Record, The Irish Times, RTÉ.
Leave a Reply