A federal minister owns one. So does roughly a third of the car-buying public walking into Australian dealerships this year. On September 21, 2026, ABC News published a Four Corners investigation showing how easily a cybersecurity researcher broke into a BYD Shark 6, one of the best-selling vehicles in the country. He did not need to defeat encryption or write custom exploit code. The entry point he used, according to the report, was an unpassworded Android Debug Bridge (ADB) port, a diagnostic interface built into the vehicle’s software that, as ABC detailed, simply had no password at all protecting it.
The finding lands at an awkward moment. Electric and plug-in hybrid vehicles now account for close to a third of new car sales in Australia, and more than half of those are built by Chinese manufacturers, led by BYD. The country has no minimum cybersecurity standard for any of them. That gap, combined with a live demonstration of remote vehicle control, has turned a niche automotive-security story into a genuine cybersecurity news event, and it is why “BYD hack Australia” and “connected car cybersecurity” surged as search terms in Australia after the story broke on September 21, 2026.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Fortify Labs actually did to the BYD Shark 6
The test, carried out for the ABC’s Four Corners program, targeted a BYD Shark 6, a plug-in hybrid ute that has become one of the more visible Chinese-brand vehicles on Australian roads. Fortify Labs spent roughly two weeks probing the vehicle, which was running software version 56.1.2.2507080.1 during testing, in September 2026 before a controlled road test, during which a remote operator working from outside the vehicle was able to lock the doors, blast music through the speakers, take over the infotainment screen, trigger the windscreen wipers and washer fluid at will, and flick the headlights on and off. The test culminated in the remote operator cutting the vehicle’s headlights entirely while it was still moving, according to the ABC’s reporting.
The researcher behind the test was Dan Hreszczuk, co-founder of the Canberra-based firm Fortify Labs. He also accessed the car’s microphone, which the ABC’s investigation found was enough to eavesdrop on phone calls placed through the vehicle and to track the Shark 6’s location in real time, and, through a manipulated voice-command interaction with the vehicle’s Siri integration, pulled personal data off the connected device. ABC News repeated the finding again on September 22, 2026, the day after the Four Corners segment first aired, which undercut any suggestion that the result was a one-off editing artefact. Critical driving systems, including brakes and cameras, reportedly held up and were not compromised, which matters, but it does not make the rest of the findings less alarming.
“It was easier than we were expecting. The access we took advantage of didn’t even have a password.”
Dan Hreszczuk, co-founder, Fortify Labs, via ABC News
That single detail, the missing password, is doing most of the work in this story. It is not a sophisticated zero-day. It is the automotive equivalent of leaving a front door unlocked in a neighborhood that assumed everyone already had a key.
BYD’s rise from unknown to Toyota rival
Four years ago, BYD was a name few Australian car shoppers recognized. That has changed fast. The brand sold more than 52,000 vehicles in the first half of 2026, according to RACV figures, making it Australia’s second-most popular car brand behind only Toyota, which led the market with roughly 95,000 vehicles over the same six months. Its Sealion 7 model ranked seventh among all vehicles sold in April 2026, when BYD held 8.3% of the new car market that month, and other Chinese brands, including Chery’s Tiggo line and Haval’s Jolion, also cracked the national top ten. BYD Australia has since delivered its 150,000th vehicle, a Seal 6 Touring plug-in-hybrid wagon handed over through BYD Warrnambool, and one report puts its year-to-date share at 8.4%, with 76,614 vehicles sold through September. Trade Minister Don Farrell is among the BYD Shark 6 owners named in reporting on the story, underscoring how mainstream the brand has become even inside government circles.
That growth is the reason this particular hack matters more than a typical proof-of-concept demo. A vulnerability in a niche import affects a handful of owners. A vulnerability in a top-two-selling brand affects a meaningful share of the national fleet, plus every dealership, insurer, and fleet manager who assumed connected-car security was someone else’s problem.
No minimum standard: the regulatory hole nobody has closed
Australia currently has no minimum cybersecurity standard for motor vehicles. Manufacturers are not required to patch software on a defined schedule, run a vulnerability disclosure program, or maintain a documented cybersecurity risk-management process for connected vehicles sold in the country. As multiple outlets covering the story have noted, connected household appliances such as washing machines and vacuum cleaners currently face more regulatory scrutiny in Australia than cars do.
Government consultation on new cybersecurity rules for vehicles has started, but enforcement is not expected for years. That timeline puts Australia meaningfully behind comparable markets, several of which have already moved on this exact issue.
How Australia’s rules compare to the US, UK, and EU
| Market | Minimum cybersecurity standard for cars | Chinese hardware/software restriction | Status as of Sept. 2026 |
|---|---|---|---|
| Australia | None | None | Consultation underway, enforcement years away |
| United States | Federal rules in place for connected vehicle systems | Restrictions on importing vehicles using Chinese or Russian hardware/software | Enforced, aimed largely at Huawei-linked components |
| United Kingdom | Automotive cybersecurity requirements tied to UN regulation | Military bans Chinese EVs within 3km of sensitive defence sites | Enforced for defence-adjacent locations |
| European Union | UN R155/R156 cybersecurity and software-update regulations mandatory for new vehicle type approval | No blanket restriction, case-by-case scrutiny | Enforced since 2024 for new vehicle types |
| China (domestic) | Data-security rules for connected vehicles | Bans foreign EVs from military sites and political enclaves | Enforced domestically |
The US restriction on Chinese and Russian vehicle hardware and software was built with Huawei-linked components in mind, not BYD specifically, but it illustrates a broader point: Australia’s security partners have already decided that connected-vehicle software from adversarial states deserves scrutiny that ordinary consumer electronics does not get. Australia has not made the same call, at least not yet.
ASIO’s warning to Parliament, and a 30% Chinese-EV fleet
The domestic intelligence angle predates this specific hack. ASIO Deputy Director-General Lisa Alonso Love addressed the issue directly during Senate Estimates, warning ministers and public servants against having sensitive conversations inside connected vehicles or plugging work devices into them.
“Obviously, a connected car may have other vectors to gather that information, but those conversations should only ever happen in places that are set up for classified conversations.”
Lisa Alonso Love, ASIO Deputy Director-General, via SBS News
The scale of exposure inside government is not small. More than 30% of vehicles available under Australia’s parliamentary vehicle scheme are Chinese-built EVs, including models from BYD and MG. Liberal MP Mary Aldred summed up the underlying concern in comments reported by The Nightly.
“We’re essentially talking about computers on wheels when it comes to EVs.”
Mary Aldred, Liberal MP, via The Nightly
Alastair MacGibbon, Australia’s former national cyber security adviser, has separately called for clearer rules on what vehicle data can be sent overseas and greater protection for data collected by connected cars generally, not just Chinese-made ones.
What connected cars actually collect
The BYD Shark 6 hack is really a vivid entry point into a much bigger data problem. Modern connected vehicles generate an estimated 1 to 2 terabytes of raw sensor data per day. In 2021, roughly half of vehicles on Australian roads were internet-connected. The Australian Signals Directorate estimates that figure will reach 93% of new vehicles sold within five years, and separate projections put total connected-vehicle penetration at 95% by 2035.
A 2023 Mozilla Foundation review of 25 car brands found that none passed its privacy assessment, prompting the foundation to call vehicles the worst product category it had ever reviewed for privacy, a finding The Conversation has cited in its own coverage of connected-car risk. Reuters separately reported in 2023 that Tesla employees had internally shared what the report described as highly invasive videos and images captured from customer vehicles. Neither of those episodes is new, but they form the backdrop against which the September 2026 BYD findings are landing.
The University of Technology Sydney take
“Most people haven’t fully ingested how many data points are being collected in a vehicle. The tech has moved away from being something simple to being a computer with a microphone, cameras, personal data, everything.”
Montii Abid, cybersecurity consultant, University of Technology Sydney, via SBS News
Which data categories different automakers collect
| Data category | Reported by | Manufacturers flagged | Notes |
|---|---|---|---|
| Location and route history | Global manufacturer review, cited by ABC/SBS reporting | Widespread across 25 reviewed brands | Includes destination and speed logs |
| Voice and microphone audio | Fortify Labs test, ABC News | BYD (test vehicle) | Accessed via compromised entry point, no password |
| Biometric data (facial expressions, weight) | Global manufacturer review | Multiple brands, incl. KIA, Hyundai | Shared with third parties per SBS reporting |
| Video/image clips from inside and outside vehicle | Reuters (2023), cited in current coverage | Tesla | Reuters reported internal employee sharing of clips |
| Phone contacts and call/message records | The Conversation | Multiple brands | Tied to infotainment phone-pairing features |
Consumer group CHOICE has looked at this same landscape and found the problem is not confined to Chinese brands.
“Whether those concerns are also shared for Chinese companies or not, our research didn’t look at that, but we found a wide range of companies from a wide range of countries that had concerning practices.”
Jarni Blakkarly, CHOICE, via SBS News
That framing matters for how this story develops. It would be easy to read the BYD findings as a Chinese-brand problem alone. The wider reporting suggests a Chinese-brand-plus-everyone-else problem, with Australia’s near-total absence of vehicle cybersecurity regulation as the common thread.
BYD’s response, and what it leaves unanswered
BYD has stated that it collects and stores Australian customer data within Australia, and says it has not transferred, and would not transfer, Australian customer data to Chinese authorities. That statement addresses data storage location and government access, which is the question the company is most frequently asked. It does not directly address the specific access-control gap that Fortify Labs demonstrated, namely an entry point that lacked password protection. BYD did go further on the technical root cause in October 2026, telling reporters it had traced the issue to a software defect in the vehicle’s Android Debug Bridge interface, though it has not published a patch timeline for vehicles already on Australian roads. Software patch cadence, vulnerability disclosure policy, and remote-command authentication are separate engineering questions from where customer data physically sits, and the company’s public statements so far have focused on the former two points rather than a concrete fix.
BYD has also pushed back on the demonstration itself, saying the ABC’s footage did not conclusively prove that a remote attack was possible without physical access to the vehicle. That objection, even taken at face value, sidesteps the core finding. Hreszczuk has been specific that the access point he used carried no password at all, and a missing password is an authentication failure regardless of how many steps in the demonstrated chain involved a researcher’s hands on the car at some point. Neither of BYD’s two statements, on data location or on physical access, addresses patch cadence, vulnerability disclosure policy, or remote-command authentication, which remain the open engineering questions Fortify Labs raised.
Where the Shark 6 Fix Stands
BYD’s confirmed finding is that BYD Australia and technical teams in Australia and China identified the issue as a software defect involving an unintended route to enable Android Debug Bridge (ADB) through the infotainment interface, allowing installation of an untrusted application. Between 1 and 4 October 2026, BYD said it had developed a remediation that removes the unintended ADB-enabling pathway. On October 1, 2026, BYD said it would issue a remote security update for the Shark 6 and investigate the reported issue.
The available reports do not confirm that the over-the-air update has been released or installed, so the remediation is announced rather than confirmed as deployed. Some reports claim BYD is checking other vehicles using related infotainment systems, but a confirmed official list of affected models is not available in the cited results. Owners of other BYD models should therefore treat the scope of the problem as unconfirmed rather than assume either that it is limited to the Shark 6 or that it is not.
The phrase “no password” is media shorthand for the researcher’s reported access path, not a confirmed statement that the vehicle had no cybersecurity controls whatsoever. The investigation did not demonstrate access to the brakes or cameras. The Shark 6 also remains a current Australian plug-in-hybrid ute: BYD’s official offers page listed the Shark 6 Premium from $57,900 driveaway in its 30 September 2026 snapshot, with free on-road costs under the offer terms. For buyers and current owners, the practical step is to ask the dealer or BYD directly whether the over-the-air update has reached a specific vehicle, since public reports do not yet say it has.
The enforcement gap: OAIC’s slow-moving probes
Australia’s privacy regulator, the Office of the Australian Information Commissioner, has opened 18-month investigations into Toyota and Hyundai over data-handling practices, and separately examined two Asian manufacturers earlier this year, though two additional probes were reportedly dropped due to low likelihood of successful enforcement. No investigation into a Chinese automaker’s data-tracking practices has been opened, and the Attorney-General’s Department has confirmed it has not met with Chinese manufacturers on the subject.
Part of the problem is structural. Australia’s Privacy Act dates to 1988, decades before any car shipped with a cellular modem, a microphone array, or a facial-recognition camera pointed at the driver. The European Union’s GDPR, by contrast, took effect in 2018 and was written with exactly this kind of always-on data collection in mind. Australia has been trying to retrofit 1988-era privacy law onto 2026-era hardware, and the BYD Shark 6 hack is a fairly direct illustration of where that approach falls short.
Historical context: this problem is a decade old
Remote vehicle compromise is not a new category of research. Security researchers have been remotely manipulating steering, brakes, and transmission in test vehicles for more than ten years, and those earlier demonstrations eventually pushed manufacturers toward better network segmentation between infotainment systems and safety-critical controls. That history is part of why the Fortify Labs test drew a small amount of reassurance from the fact that brakes and cameras held up under testing. It is also why the missing password on a customer-facing feature reads as a step backward rather than a new kind of risk. The vulnerability class here, weak or absent authentication on a connected feature, is more basic than the kind of research that made headlines a decade ago, not more advanced.
Market impact: automakers, insurers, and fleet buyers
For automakers, the immediate cost is reputational, not financial, since Australia has no regulator empowered to fine a car company over a missing password today. That could change once the government’s ongoing consultation produces an actual standard, at which point compliance costs would land on every brand selling connected vehicles in the country, not just BYD. Fleet buyers, including government agencies, now have a concrete reason to add cybersecurity questions to procurement checklists that historically focused on price, warranty, and charging infrastructure. Insurers who write policies on connected vehicles may also start asking manufacturers for evidence of a documented vulnerability-management process, mirroring how cyber-insurance underwriting evolved for corporate IT a few years ago.
For BYD specifically, the timing is awkward given how hard the brand has worked to convert Australian buyers away from Toyota. A second-place market share built on price and product now has to coexist with a national news story about a car that could be remotely operated by someone without a password. Whether that dents sales depends on how the company responds in the coming weeks.
Five predictions for the next 12 months
- Australia’s government consultation on vehicle cybersecurity standards will move faster than the “years away” timeline currently expected, given the political attention this story is generating in Canberra.
- BYD will publish a more detailed technical response addressing the specific access-control weakness, separate from its existing statement about data storage location.
- The OAIC will face public pressure to open a formal investigation into at least one Chinese automaker’s Australian operations before mid-2027.
- Other manufacturers, not just Chinese brands, will face similar ethical-hacking scrutiny from Australian media and researchers, given CHOICE’s finding that the problem spans multiple countries of origin.
- Government fleet policy for parliamentarians and public servants will tighten further, building on ASIO’s existing guidance about sensitive conversations in connected vehicles.
What owners can do right now
Consumer advice from cybersecurity researchers covering this beat has stayed fairly consistent: review the manufacturer’s privacy agreement at the point of purchase rather than after, check a vehicle’s specific data practices using its VIN through resources like vehicleprivacyreport.com, decline manufacturer SIM card installation where the option exists, turn off optional data-collection features through the infotainment menu or companion app, and factory-reset a vehicle before selling it or handing it to a valet or rental customer. None of that fixes an authentication flaw on the manufacturer’s side, but it limits how much a compromised or resold vehicle exposes about its owner.
Frequently asked questions
What exactly did the cybersecurity expert hack in the BYD?
Dan Hreszczuk of Fortify Labs found an access point on a BYD Shark 6 that had no password protection. Through it, he remotely operated door locks, speakers, the infotainment screen, wipers, washer fluid, and headlights, and accessed the microphone during a road test documented by ABC News’ Four Corners program.
Were brakes or other safety-critical systems affected?
According to the ABC’s reporting, critical functions including brakes and cameras were well-protected and were not compromised during the test. The vulnerability was in customer-facing connected features, not core driving controls.
Does Australia have any cybersecurity rules for cars?
No. Australia currently has no minimum cybersecurity standard for motor vehicles. A government consultation process is underway, but enforcement is not expected for years, according to reporting on the story.
Is this only a problem with Chinese-made cars?
No. Consumer group CHOICE has said its research found concerning data practices across manufacturers from a range of countries, not Chinese brands exclusively. The Mozilla Foundation’s 2023 review of 25 car brands found none passed its privacy assessment.
What has BYD said in response?
BYD says it collects and stores Australian customer data within Australia and states it has not transferred, and would not transfer, that data to Chinese authorities. BYD has also said the ABC’s footage did not conclusively prove a remote attack was possible without physical access to the vehicle. Neither statement has directly addressed the specific password-related access issue identified in the test.
Did BYD dispute that the hack required no physical access?
Yes. BYD told reporters that the ABC’s footage did not conclusively prove a remote attack was possible without physical access to the vehicle. Fortify Labs has not withdrawn its core finding, that the access point used in the test carried no password at all, which is an authentication gap independent of that dispute.
How many Chinese-made EVs are in the government’s own vehicle fleet?
More than 30% of vehicles available under Australia’s parliamentary vehicle scheme are Chinese-built EVs, according to reporting cited alongside ASIO’s warning to ministers and public servants about sensitive conversations inside connected vehicles.
What should current BYD or other connected-car owners do?
Security researchers recommend reviewing the manufacturer’s privacy terms, checking data practices via the vehicle’s VIN, disabling optional data-collection features in the infotainment system, and factory-resetting the vehicle before resale, loan, or trade-in.
Is BYD still Australia’s second-best-selling car brand?
Yes. BYD sold more than 52,000 vehicles in the first half of 2026, according to RACV, remaining Australia’s second-most popular brand behind Toyota’s roughly 95,000 first-half sales. BYD also held 8.3% of the new car market in April 2026 specifically, with its Sealion 7 model placing seventh among individual vehicles sold that month.
