India's cyber safety agency, CERT-In, has warned that two Tata Motors car apps had serious security gaps. Tata Motors Passenger Vehicles said on Thursday, 5 November 2026, that the problems have already been fixed through software updates.
The apps, iRA 2.0 and iRA.ev, let owners check and control their cars from a phone. The company says it found no sign that customer data was misused. Separately, Tata Sons Chairman N Chandrasekaran met Italy's Prime Minister after Tata Motors took control of truck maker Iveco.
What CERT-In warned about
On Wednesday, 4 November, the Indian Computer Emergency Response Team (CERT-In) flagged weaknesses in some versions of the two apps, according to Economic Times. CERT-In is the central agency that handles cyber attacks and online safety threats.
It rated the severity as High. The agency warned that attackers could steal login details, pretend to be a real user and reach vehicle information and services without permission.
Owners use these apps for connected vehicle features. These include vehicle status, health monitoring, trip details and remote commands, such as sending an instruction to the car from a phone.
| App | Versions with the problem | Safe version advised | Update rolled out |
|---|---|---|---|
| iRA 2.0 | 26.7.3 and below | 26.8.2 | August 2026 |
| iRA.ev | 26.7.2 and below | 26.9.1 | September 2026 |
The table shows which versions CERT-In called unsafe and which newer versions it asked users to install. The rollout months come from the company spokesperson.
The four weak spots, in plain words
CERT-In found four weaknesses. They relate to how the apps store login details, handle web content and talk to the company's back-end systems. The Hindu BusinessLine quoted the advisory in more detail:
- Secret keys inside the app: Account login details, API keys and authorisation tokens were written directly into the app package. An attacker could download the app, pull these out and reach the company's back-end services.
- Weak checks on web pages: The app's WebView part did not properly check the web addresses it loaded. An attacker could send harmful web content, grab live login tokens and act as the user.
- Tokens left in logs: Login tokens were saved in logs that developers use to find bugs. Someone with access to those logs could reuse them to pose as the user.
- A weak lock on the connection: SSL certificate pinning was not set up properly. An attacker watching network traffic could read or change messages between the app and its servers.
A simple way to picture it: the first problem is like a spare house key left under the doormat. The last is like a door that does not check who is knocking.
What Tata Motors PV said
A company spokesperson told both newspapers that the weaknesses have been fixed through software updates and stronger security measures.
According to the spokesperson, mandatory updates to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 were rolled out in August and September 2026. The update request appears automatically when a user opens the app. It is downloaded over the air and takes a few minutes.
The company said the rollout is complete for all active users. It is contacting the remaining customers who have not yet updated.
The spokesperson said the company's own assessment found no evidence of unauthorised access to customer credentials, personal information or vehicle data. The company added that it keeps monitoring its systems.
Two points are worth noting. The fixed versions came out months before CERT-In's public warning, and neither report explains this timing. Also, the "no evidence" finding comes from the company's own review.
What car owners can check
If you use either app, open your phone's app store or the app's settings and look at the version number. If iRA 2.0 shows 26.7.3 or lower, or iRA.ev shows 26.7.2 or lower, CERT-In advises moving to the newer version.
The Iveco deal and the Rome meeting
In other Tata news, Chandrasekaran met Italian Prime Minister Giorgia Meloni at Palazzo Chigi in Rome on Wednesday, Economic Times reported, citing sources. He presented the Tata Group's plan after buying control of Iveco Group, an Italian maker of trucks, buses and power trains.
On 30 October, Tata Motors said it had bought an 89.42% stake in Iveco for nearly 3.43 billion euros. This followed the first settlement of its cash tender offer.
| Item | Figure |
|---|---|
| Stake bought in Iveco | 89.42% |
| Price paid | Nearly 3.43 billion euros |
| Combined revenue of both companies | 21 billion euros (about ₹2,28,000 crore) |
| Countries where they are present | Over 130 |
The combined figures come from a joint statement by the two companies. Iveco is now an indirect subsidiary of Tata Motors.
At a press conference in Turin on Tuesday, Chandrasekaran thanked the Italian government, Meloni and Minister Adolfo Urso for their support. He recalled that the design of Tata Motors' first Indian-made car took shape at Turin design house Idea in the late 1990s. "We owe it to Turin for our passenger car business," he said.
He said the two companies are looking at strong growth in volumes, revenues and margins over the next five years. This is a company goal, not a result. The next step is joining the two businesses and planning together.
What it means for a small investor
The two stories touch different parts of the Tata Motors business. The app issue is about trust. Connected cars handle a lot of personal data, and buyers want it kept safe. A quick fix and no reported data loss help, but the safety finding rests on the company's word.
The Iveco deal is far larger. It gives Tata Motors a big truck and bus business in Europe, much like Adani Ports' recent deal for Evos. But joining two big companies takes time and money, and five-year goals may not be met. The reports did not mention any share price moves.
Risks and what to watch
- Whether all remaining customers move to the safe app versions.
- Any further notice from CERT-In or the company about these apps.
- Iveco joining costs and progress in Tata Motors' quarterly numbers, which we cover on our results page.
- Official deal details in company filings on the BSE and NSE websites.
Words explained
- CERT-In: The Indian Computer Emergency Response Team. It is the central government agency that deals with cyber security threats.
- Over the air update: A software update sent through the internet, with no visit to a service centre.
- Token: A digital pass the app uses to prove you are logged in. If stolen, someone could act as you.
- WebView: A part of an app that shows web pages inside it, like a small browser.
- SSL certificate pinning: A check that makes the app talk only to its real server, not to a fake one in between.
- Tender offer: An open offer to buy shares directly from a company's shareholders at a set price.
- Indirect subsidiary: A company controlled by another company through a third company in between.
- Margin: The share of sales left as profit. If a firm sells goods for ₹100 and keeps ₹10, its margin is 10%.
Sources: Economic Times, The Hindu BusinessLine.
This article is for information and education only. It is not investment advice. MarketUpDown is not registered with SEBI as an investment adviser or research analyst. Read our disclaimer.