Government Probes BAT-BMS App for Hacking E-Rickshaws

Indiatoday.In

Government Probes BAT-BMS App for Hacking E-Rickshaws

First seen 3 Jul 2026, 13:32 UTC • •68.3

Article Content

1 / 10

Browse articles

ThreatCluster •July 4, 2026 at 11:22 UTC

•BAT-BMS app misused to remotely disable e-rickshaws, affecting drivers' livelihoods.
•Legal consequences for using the app include up to three years' imprisonment and fines.
•Government has removed the app from major app stores and is investigating its security flaws.

The BAT-BMS app has come under government scrutiny after videos surfaced showing users remotely disabling e-rickshaws via Bluetooth. This misuse has led to significant disruptions for drivers, affecting their livelihoods. Cyber law expert Pavan Duggal stated that such actions constitute a legal offense under the Information Technology Act, with penalties including up to three years in prison and fines up to Rs 5 lakh. The Ministry of Electronics and Information Technology (MeitY) has removed BAT-BMS and similar apps from app stores and is investigating their vulnerabilities. The app, developed by Shenzhen Grenergy Technology, was initially intended for battery management but has been exploited for malicious purposes. The situation has prompted public outcry, with calls for a ban on the app and increased scrutiny on connected devices.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 99d ago How this analysis works

Timeline

2026-07-01

Viral videos show BAT-BMS misuse

Videos emerged showing users disabling e-rickshaws using the BAT-BMS app, causing public concern.

2026-07-03

Government removes BAT-BMS from app stores

MeitY confirmed the removal of BAT-BMS and similar apps from Google Playstore and Apple Appstore.

2026-07-03

Cyber law expert warns of legal consequences

Pavan Duggal stated that using the app to hack e-rickshaws is a cyber offense punishable under the IT Act.

More articles in this cluster (9)

Threat Graph

2 entities, 1 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Weakness (1)

CWE-287 - Improper Authentication

Affected Platform (1)

Bluetooth

Relationships

Bluetooth related to CWE-287 - Improper Authentication

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…