A cybersecurity expert hacked a BYD Shark 6 in Australia through an access point with no password. Dan Hreszczuk of Fortify Labs tested the plug-in hybrid ute for two weeks for ABC's Four Corners. He switched off the headlights while it was moving, locked the doors and turned on the cabin microphone. He could not reach the brakes or the cameras. BYD says it has not handed Australian data to Chinese authorities.
What the Hacker Did on the Road
ABC published the test on September 21, 2026. Reporter Angus Grigg drove the Shark 6 on a country road outside Canberra. Hreszczuk sat by the roadside with a laptop.
He locked the doors while Grigg was inside. He played loud music and showed images on the infotainment screen. He also ran the wipers at top speed, sprayed washer fluid and flicked the lights on and off.
Grigg was driving at about 30 km/h. Then Hreszczuk turned the headlights off completely.
He got in through an access point with no password. "The access we took advantage of didn't even have a password," he told ABC.
What he could control: door locks, speakers, infotainment screen, wipers, washer spray, headlights, the cabin microphone and the car's live location.
What he could not reach: the brakes and the cameras. He said both were well protected.
The Microphone and Siri Test
Hreszczuk tracked the ute live as Grigg drove through central Canberra. Then he switched on the cabin microphone. Grigg was on a call, helping his mother set up internet banking. He read out a temporary password during the call, and Hreszczuk recorded all of it.
He had also recorded Grigg saying the wake phrase for Siri. At a service station, Grigg left his iPhone unlocked in the car. Hreszczuk stitched the clip together with his own voice asking questions. He then played it through the car's speakers.
The phone answered. It gave up the owner's home address, date of birth, age and a saved contact's number. Within minutes, Hreszczuk also had the banking password from the earlier call.
What BYD Said
BYD says the data it collects is stored in Australia. It also says it has not handed Australians' data to Chinese authorities and would not do so.
Why Australia Has No Rules for This
Australia has no minimum cybersecurity standards for cars. That means BYD does not have to keep its software updated or run a system to manage cyber risks. ABC notes that connected washing machines and vacuum cleaners face more rules than cars.
Cyber Security Minister Tony Burke says the government started with household devices. He said it wanted to act first where it could see quick results and where most attacks have happened. Talks with industry on car rules have begun, but ABC says new rules are likely years away.