Porsche outage in Russia serves as a reminder of the risks in connected vehicle security

Hundreds of Porsche cars in Russia became undrivable due to a malfunction in their factory-installed satellite security system, owners say.

Hundreds of Porsche cars in Russia became undrivable after their factory-installed satellite security system malfunctioned, owners and dealers report.

Drivers in several Russian cities reported sudden engine shutdowns and fuel-delivery blocks after Porsche cars lost satellite alarm-module connectivity, leaving all models at risk of self-locking, according to dealership group Rolf.

The problem appears to be caused by the Vehicle Tracking System (VTS), which is an onboard module.

According to the Russian website RBC, the incident shows that any Porsche can be immobilized through its factory alarm system. The outlet suggests resolving the issue by disassembling and resetting the alarm unit.

The car owners have begun requesting service more frequently due to the problem with their standard satellite alarms, the Rolf dealership told RBK. Rolf observed a surge in the service requests starting on November 28.

“Currently, there is no connection for all models and types of internal combustion engines (ICEs – RBC ). Any vehicle can be blocked. Currently, the blocking can be bypassed by resetting the factory alarm unit and disassembling it. We are continuing to investigate the issue and the mechanic’s options for unlocking the vehicles,” said the company’s Service Director, Yulia Trushkova.

A Rolf representative told RBC that all Porsche models are affected and could automatically lock themselves. The representative suggested the outage might have been deliberate, though no evidence supports this claim.

Some Porsche owners in Russia managed to restore their cars by disabling or rebooting the VTS system, while others succeeded after disconnecting the battery for hours, according to Russian Porsche Macan Club.

The starting problem does exist, but it has already been resolved—you need to manually disable the VTS” a Porsche Macan Club representative explained.

Rolf said experts are still investigating the cause. Porsche’s Russian and global offices have not commented. Although Porsche suspended sales and operations in Russia after the 2022 invasion of Ukraine, it still owns three local subsidiaries it has been unable to sell.

Porsche has not yet commented on the embarrassing problem.

Porsche stopped deliveries and suspended operations in Russia after the 2022 invasion of Ukraine, but it still owns three local subsidiaries that it has been unable to sell.

This incident highlights the fragility and potential risk that connected vehicle security systems introduce when they become a single point of failure. A malfunction in Porsche’s satellite-linked VTS module was enough to immobilize hundreds of cars, demonstrating how deeply digital controls now influence physical safety and mobility.

While there is no evidence of a deliberate attack, the situation underscores how attractive such systems could be for threat actors. A coordinated compromise of remote immobilization features could disrupt fleets at scale, create public-safety hazards, and be leveraged for coercion or geopolitical pressure.

The episode should serve as a wake-up call for the automotive industry: security-critical components must be resilient, fail-safe, and designed with the assumption that remote systems may fail — or be targeted. Robust incident response, clear communication, and transparency about root causes are essential to maintain trust when technology can literally stop a vehicle on the road.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)