BYD Got Hacked? What Really Happened

Last Updated on September 22, 2026 by Arnav Sharma

If you have seen headlines asking whether BYD got hacked, the short answer is yes, but not by criminals. In a controlled test for Four Corners, a researcher spent two weeks with a Shark 6 plug-in hybrid pickup, found an entry point with no password, and then took over its lights, doors, audio and cabin mic while a journalist sat behind the wheel. Days later, the same investigation exposed a quiet rewrite of the company’s data policy.

This breakdown covers what actually happened, which findings matter most for defenders, what the test did not prove, and what owners and fleet teams anywhere in the world should do next.

What Happened in the ABC Four Corners Test

The investigation was fronted by reporter Angus Grigg, working with Dan Hreszczuk, co-founder of the Canberra firm Fortify Labs and a specialist in automotive intrusion testing. The national broadcaster handed him a Shark 6 from one of the world’s largest EV makers with a simple brief: find out what the Shenzhen-based company, or anyone with equivalent reach, could see and do from a distance.

The timing is not academic. Electric and plug-in hybrid models made up almost a third of new sales in that market this year, and more than half of those came from PRC brands. The findings went public on 21 September 2026, with a second report on the company’s data policy following a day later.

Question	What was reported
Test unit	One Shark 6 plug-in hybrid pickup
Preparation time	Two weeks with the pickup before the road demonstration
Entry point	An interface with no authentication at all
Features reached	Doors, speakers, infotainment display, washers, lights, cabin mic, live location
Features not reached	Braking and camera systems
Published fix or advisory	None at the time of writing
Criminal use in the wild	None reported

How the Hacker Got In Without a Password

Hreszczuk’s verdict was blunt: “The access we took advantage of didn’t even have a password.” He also said the job proved easier than his team expected, which is telling from someone who breaks into these machines for a living.

A modern pickup is a rolling network. Dozens of electronic control units sit on internal buses such as CAN and automotive Ethernet, fronted by a telematics unit and an infotainment head unit that talk to phones, mobile networks and the maker’s cloud infrastructure. That edge is where authentication matters most. Anyone who can gain access to an open interface there has the automotive equivalent of an admin console exposed to the internet with no login page.

Once inside, the work became reverse engineering the code behind each cabin function, one feature at a time, until Hreszczuk could trigger them on demand from a laptop.

What the public reporting does not tell us is just as important:

• The entry route. It is unclear whether the interface needed physical contact (a diagnostic port, USB or debug header), local wireless proximity (Bluetooth or the onboard hotspot) or a route through the cloud.
• The affected builds. No model year, firmware version or regional variant was identified.
• The preparation. Two weeks of possession may have included setup steps a real adversary could not repeat on a stranger’s pickup.
• The disclosure trail. No vulnerability identifier, advisory or patch has been published.

Those gaps decide the scale. A debug header that needs a screwdriver is a serious engineering failure. A cloud-reachable service with no authentication is a fleet-wide emergency. Right now, nobody outside the company and the researchers can say which one this is.

What He Could Control Remotely While the Pickup Was Moving

The road demonstration took place just before midnight on a narrow country road outside Canberra. With Grigg driving at roughly 30 km/h, Hreszczuk sat on the verge with a laptop and worked through a sequence:

1. He locked the doors with the journalist inside.
2. He blasted music through the speakers and pushed images to the large infotainment display.
3. He switched the windscreen wipers to full speed and fired the washer jets.
4. He flicked the lights on and off while the cabin speaker repeated a prompt to use low beam.
5. He cut the headlights completely, leaving the pickup in darkness on an unlit road.

None of this touched steering or braking. It would still be a mistake to file it under nuisance. Losing forward lighting while the washers fire on a winding road at highway speed is a crash scenario, and in the hands of a malicious actor the distraction alone could be enough. Most safety engineers would treat these as safety-relevant body features, not comfort extras.

How Cabin Audio Was Used to Steal a Banking Password

The second demonstration was quieter and, for most readers, more alarming. It chained the pickup-side foothold with ordinary smartphone behaviour.

1. Live tracking. Hreszczuk followed the pickup’s position in real time as Grigg drove through central Canberra.
2. Cabin eavesdropping. He switched on the in-cabin microphone and recorded a phone call in which Grigg talked his mother through a temporary online banking login built from his initials, house number and date of birth.
3. Wake-word capture. The same recording contained Grigg saying “Hey Siri”.
4. Voice injection. At a service station, Grigg left his iPhone in the cabin, awake and past its passcode screen. Hreszczuk spliced the captured wake word onto his own questions and played them through the pickup’s speakers.
5. Data extraction. Siri answered with Grigg’s home address, date of birth and age, which was enough to rebuild the credential. It then read out a former prime minister’s number from his contacts.

The phone itself was never compromised. It was simply talked into answering. That is the lesson practitioners should take away: once an intruder can listen through a cabin and speak through its speakers, every voice assistant in range becomes an injection point. The credential pattern did the rest, because anything built from personal facts can be rebuilt from personal facts.

It is also worth being precise. This chain depended on staged conditions, including a phone left active and unattended, and it should not be generalised to every handset or configuration.

What Held Up: The Safety Systems Stayed Out of Reach

Most coverage skipped the most useful defensive finding. Hreszczuk said he could not reach the brakes or cameras, describing them as well protected.

That pattern, with body and infotainment features exposed but chassis and camera domains closed off, is consistent with a segmented network architecture in which a central gateway filters which messages may cross between domains. The public reporting does not describe the Shark 6’s internal design, so treat this as an informed reading rather than a confirmed teardown. Even so, remote access to body and infotainment features did not extend to the chassis, and the contrast with earlier cases is striking.

Case	Year	Entry point	What researchers reached	Outcome
Jeep Cherokee (Miller and Valasek)	2015	Mobile network link to the head unit	Transmission, plus braking at low speed	About 1.4 million units recalled
Kia owner and dealer portals (Curry and team)	2024	Web portal and API flaws	Location, doors, engine start and horn, using only a licence plate	Fixed by mid-August 2024
Shark 6 (Hreszczuk)	2026	Unauthenticated entry point, details undisclosed	Lights, washers, doors, audio, mic and location	No public fix yet

In 2015, a pivot from infotainment reached the powertrain. In 2026, the safety domain held. That is real progress, and it shows what defence in depth looks like when one layer works. The failure here was at the edge: segmentation limited the blast radius, but nothing stopped the intruder at the front door.

Where AI Makes In-Cabin Access Far More Dangerous

The Siri trick used a crude audio splice. Machine learning strips most of the effort out of every step of that chain.

• Voice cloning. Modern AI voice models can produce convincing speech from a short sample. A cabin mic is a continuous sample source, which turns one captured wake word into any command in the owner’s voice. Voice matching on the phone offers little help when the input is the owner’s own recorded or synthesised voice.
• Bulk listening. No analyst could review thousands of hours of cabin audio. An AI transcription and language model pipeline can, flagging every spoken credential, account number, address or meeting. That shifts in-cabin eavesdropping from a targeted operation to a bulk one.
• More assistants. Many new models ship with their own AI voice assistant tied to navigation, messages and settings. Each one is another voice-driven interface that can be addressed through the speakers.
• Defence benefits too. AI-driven anomaly detection in VSOCs (the automotive equivalent of a SOC) can flag abnormal bus traffic and unexpected remote commands, the kind of monitoring a mature management program should include.

The takeaway is that the audio half of this demonstration will get cheaper and easier to run at scale every year, even if the entry point itself is fixed tomorrow.

BYD’s Policy Rewrite: What Changed After the Journalists Asked

In a follow-up on 22 September, the investigation reported that the company had scrubbed every reference to ‘China’ and ‘surveillance’ from its Australian privacy policy, just days after the journalists sent questions about it.

The detail matters more than the headline:

Clause	Original policy	Revised policy
Named destinations for owner data	16 countries, including the PRC	PRC reference removed
Monitoring language	Collection permitted where linked to suspected illegal or improper activity, including through monitoring	Removed
Scope	Applied to owners of its models	Website says it no longer applies to them and points to a separate in-app document
Storage location	Stored in Australia	Stored in Australia
Offshore transfer	Permitted	Still permitted, subject to applicable law

The revised version went live on the company’s local website one hour and 16 minutes before the company sent it to the journalists. Its transfer clause says the company “will comply with applicable data protection laws regarding cross-border data transfers”, which constrains the paperwork, not the destination.

UNSW data protection law expert Katharine Kemp said the original wording gave highly concerning signals about the company’s potential data practices, and she dismissed the new policy’s opening reassurance as empty boilerplate. The company also told the journalists it had formally responded to preliminary inquiries from the national data protection authority.

Why Deleting a Word Changes Nothing

For architects and CISOs, the point is simple: removing a word from a policy does not remove a capability. What determines exposure is where telemetry terminates, who holds the keys, which remote commands the platform supports, and which governments can compel the operator to use them.

BYD says it has not and would not hand Australians’ data to Chinese authorities. The structural issue is that companies headquartered in the PRC can be obliged to co-operate with state requests under national security laws, whatever a local policy says.

Is Every Connected Car at Risk, or Just Chinese EVs?

Both, in different ways, and it helps to separate the two threat models.

Threat model	Who it applies to	What reduces it
Engineering weakness: open interfaces, weak authentication, slow patching	Any brand	Type-approval rules, independent testing, disclosure programs, fast over-the-air fixes
Jurisdictional compulsion: a maker instructed to use its legitimate remote capabilities	Makers subject to direction by a foreign state	Data localisation, supply-chain rules, procurement limits for sensitive roles

The Jeep and Kia cases prove the first threat is industry-wide. Engineering failures are not a national trait.

The second threat is where governments are drawing lines. Alastair MacGibbon, Australia’s former national cyber security adviser, argued that the capability to cause harm with these machines is clearly present while intent is unknown, and said a cabinet minister should not own one.

The UK military has barred PRC-built models, even those with PRC-made components, from parking within 3 km of some sensitive sites. Beijing itself has kept foreign-brand models away from military sites and political compounds. In the market where this test ran, ASIO has told ministers and public servants not to hold sensitive conversations in these cabins or connect work devices, but nothing stops them owning one, and Trade Minister Don Farrell drives a Shark 6.

For a global audience, the useful takeaway is that nationality tells you about the second threat, not the first. Every fleet needs to manage both.

Vehicle Security Rules: How Regulators Compare

The test market’s gap is unusual among major economies.

Jurisdiction	Rule	Status	What it requires
EU, UK, Japan, South Korea and other adopting UN 1958 Agreement parties	UN R155 and R156	Mandatory for all new registrations since July 2024	Audited CSMS covering the full lifecycle, plus a managed update process (SUMS)
United States	Commerce Department ICTS rule	Code bans from model year 2027, hardware from model year 2030	Bars covered telematics and automated driving components linked to the PRC or Russia
PRC	GB 44495-2024	In force since 1 January 2026	Mandatory CSMS and technical protections for the home market
Australia (test market)	No minimum standard	Industry consultation has begun, rules likely years away	Nothing yet

Here is the uncomfortable detail. The maker’s home market now mandates an audited management regime, yet the market where the test took place has no minimum cybersecurity standards for road vehicles. The responsible minister, Tony Burke, defended starting with household smart products, where he argued the fastest uplift could be won. Whether export builds for lightly regulated markets receive the same hardening as builds for R155 or GB 44495 markets is precisely the question buyers and regulators should be asking.

What Owners and Fleet Teams Should Do Now

There is no published, verified mitigation for this specific entry route, so treat the steps below as sensible hygiene rather than a fix.

If You Own or Drive One

• Update through official channels. Install over-the-air firmware updates as they arrive and watch for an advisory addressing this issue.
• Make your voice assistant authenticate first. Disable assistant responses before Face ID or passcode authentication, and remember that voice matching will not stop replay of your own recorded voice.
• Never leave a phone active and unattended in the cabin. That single habit broke the chain in this demonstration.
• Stop building credentials from personal facts. Use a credential manager and passkeys, and never read a login aloud in any networked cabin.
• Prune pairings. Remove old phones from the head unit and review telematics and data-sharing settings in the owner app, including any offline mode the maker offers.

If You Manage a Fleet

• Inventory the fleet as endpoints. Treat each unit as an unmanaged IoT asset with cameras, a mic and GPS, and include the fleet in threat modelling.
• Restrict pairing. Use MDM policy to stop corporate phones pairing with fleet head units over Bluetooth, USB or phone projection, especially for executives and sensitive roles.
• Set a sensitive-conversation rule. Board, legal, M&A and government-liaison calls do not happen in any cabin, whatever the badge.
• Build it into procurement. Make the questions below part of every fleet tender, with contractual patch timelines.

Questions to Put to Any Manufacturer

1. Is this model approved under UN R155 and R156 for this market, and can you show the certificate?
2. Do you run a public disclosure program for researchers and publish advisories?
3. What is your committed patch timeline for critical issues, and for how many years?
4. Where does telemetry terminate, who holds the keys, and which jurisdictions can compel access?
5. Can owners disable cabin audio uploads, camera uploads and remote commands without losing safety features?
6. Will you provide an SBOM for the head unit and telematics unit?

The Bottom Line

This was an authorised test, not a criminal incident, and no malware was required. It does not prove fleet-wide sabotage, and it is not a verdict on one country’s engineering. What it does prove is that a software-defined vehicle is an endpoint with wheels, and an endpoint with an unauthenticated interface will eventually be found by someone less friendly than a broadcaster’s hired researcher. An unauthorized party with the same foothold would not stop at switching off the lights.

The segmentation that kept the chassis out of reach shows the industry knows how to build this properly. What is missing is authentication at the edge, honest disclosure, and enforceable rules in every market where these machines are sold. Until then, part of the attack surface sits in your driveway and your company car park.