Tata Motors says customer data is safe after CERT-In flags security flaws in connected-car apps

Tata Motors Passenger Vehicles has said it has fixed security vulnerabilities identified by the Indian Computer Emergency Response Team (CERT-In) in its connected-car applications, iRA 2.0 and iRA.ev, adding that there is no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.

“Our assessment has indicated customer data and vehicle-related information remain secure – with no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data,” Tata Motors Passenger Vehicles said, adding that it continues to actively monitor its systems to maintain the security and protection of its customers.

This comes after India's cybersecurity agency CERT-In flagged four security vulnerabilities in Tata Motors' connected-car applications, iRA 2.0 and iRA.ev, warning that they could expose sensitive user information and vehicle-related services to unauthorised access.

Don't Miss: Tata Motors shares gain 8% on Iveco synergy bets; Nomura, HSBC targets

These apps provide connected-car services to internal combustion engine (ICE) and electric vehicle (EV) owners, including access to vehicle status, health monitoring, trip information and remote vehicle commands.

In a vulnerability note issued on November 4, CERT-In classified the vulnerabilities as high severity.

CERT-In said these flaws could allow a hacker to obtain sensitive data or impersonate the car owner. The agency has advised users to upgrade their apps to address the vulnerabilities.

The company said mandatory software updates addressing the vulnerabilities were rolled out in August and September 2026 for iRA 2.0 and iRA.ev, respectively. All active users have completed the updates, while the company is reaching out to customers who have yet to update their apps.

Read More: Tata Motors to localise Iveco Group products for India: N Chandrasekaran

“The vulnerabilities identified in applications have been addressed through software updates and enhanced security measures,” the homegrown carmaker said.

“These updates are automatically prompted when users open the respective applications and can be completed over the air within a few minutes. The update rollout has been completed for all active users, and we are proactively reaching out to remaining customers who are yet to complete the updates to ensure their transition to the latest versions,” it said.