Tata Motors Passenger Vehicles has confirmed that customer data and vehicle information remain secure, with no evidence of unauthorized access, despite the Indian Computer Emergency Response Team (CERT-In) identifying high-severity security vulnerabilities in its connected-car applications.
Security Flaws Identified in iRA Apps
CERT-In, India's national cybersecurity agency, issued a vulnerability note on November 4, 2026, highlighting four significant security flaws in Tata Motors' iRA 2.0 and iRA.ev apps. These applications provide crucial connected-car services to owners of both internal combustion engine (ICE) and electric vehicles (EVs), including vehicle status monitoring, health reports, trip information, and remote commands.
The agency warned that these vulnerabilities could potentially allow unauthorized access to sensitive user data and vehicle-related services, or even enable an attacker to impersonate the car owner.
Tata Motors Responds with Software Updates and Assurance
In response to CERT-In's findings, Tata Motors stated that it had already addressed the identified vulnerabilities through mandatory software updates. The updates were rolled out in August 2026 for iRA 2.0 and September 2026 for iRA.ev. The company emphasized that all active users have completed these updates, and efforts are underway to reach out to any remaining customers who have yet to update their applications.
“Our assessment has indicated customer data and vehicle-related information remain secure – with no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data,” Tata Motors Passenger Vehicles said. “We continue to actively monitor our systems to maintain the security and protection of our customers.”
The company confirmed that these updates are automatically prompted when users open the respective applications and can be completed wirelessly within minutes. Users are advised by CERT-In to upgrade their apps to the latest versions to ensure continued security.
Ongoing Monitoring for Customer Protection
Tata Motors reiterated its commitment to actively monitoring its systems to uphold the security and protection of its customers' data. The quick deployment of patches and the assurance of no data compromise aim to restore confidence among users of its connected-car ecosystem.