A BYD pickup was hacked with no password. It's UK-bound
An Australian researcher took control of a BYD Shark 6's lights, wipers, locks and microphone. The same pickup goes on sale in the UK this year, just as new car cyber security rules bite.
A security researcher in Canberra has shown that he could take over parts of a BYD Shark 6 pickup, the plug-in hybrid pickup that has sold more than 12,000 units in Australia so far this year. He switched its headlights on and off, ran the wipers, locked the doors, tracked where it was and turned on the cabin microphone. The investigation, by ABC's Four Corners programme, was published on 21 September.
The same truck, badged simply as the BYD Shark, is due to reach British customers before the end of the year.
The access we took advantage of didn't even have a password.
— Dan Hreszczuk, co-founder of Fortify Labs, speaking to ABC News
Lights, wipers and a listening ear
According to ABC, Dan Hreszczuk of Canberra firm Fortify Labs got in through an unprotected entry point in the vehicle's software. Once inside, he could control the headlights, wipers, windscreen sprayers, door locks, speakers and infotainment screen, and see the car's location, speed and route. "It was easier than we were expecting," he told the broadcaster.
The brakes and cameras stayed out of reach, which is the good news. The bad news is that switching off someone's headlights at night on a country road is hardly harmless. Security Affairs, which covered the findings, notes that the researcher was also able to use the microphone to capture sensitive information spoken in the cabin.
BYD's side of the story
In a statement reported by EV Central, BYD said: "We take the allegations very seriously as vehicle security and safety of our customers and all road users is paramount." It also suggested the attack required "unrestricted access to the vehicle" in the first place. That's a meaningful detail, and one the reports don't fully settle. There's a big difference between a flaw anyone can reach over the air and one that needs someone to sit in your car first.
BYD also says the data it collects on Australians is stored in Australia and has not been handed to Chinese authorities. None of the reports so far mentions a software fix or a timetable for one.
It's been a bumpy month for the Shark down under. Separately, a federal safety recall covers 32,009 Shark 6s because a spare-wheel tray support cable can wear and break. None of this has dented demand much: BYD delivered 1,385 Shark 6s in Australia in August alone.
What it means on this side of the world
The Shark goes on sale here at £47,290 including VAT, and Electrek reports UK deliveries are due by the end of 2026. It isn't clear whether the UK version runs the same software as the Australian truck that was tested. That's the question UK buyers, and fleet managers in particular, should be putting to dealers.
Britain is also on firmer regulatory ground than Australia, which, as Security Affairs points out, has no minimum cyber security standard for cars. Here, a statutory instrument passed last year brought the international rules on vehicle cyber security (UN Regulation 155) and software updates (UN Regulation 156) into GB type approval. The dates matter:
- 1 June 2026: new types of vehicle can't get GB type approval unless they meet the cyber security rules.
- 1 June 2027: new complete vehicles that don't comply can no longer be registered.
In other words, the law now requires carmakers to have a proper system for managing cyber risks. It doesn't guarantee that every car is free of holes like this one, which is why independent testing like ABC's matters.
There's a national-security thread too. In April 2025, Auto Express reported that staff at RAF Wyton, a key defence intelligence base, had been told to park Chinese-made cars at least two miles away over fears about on-board microphones, GPS and sensors. Ada's take: this demo doesn't prove any spying. But it shows why those fears aren't just paranoia.
To be fair to BYD
Connected cars from every country have had embarrassing holes found in them, and researchers have picked apart plenty of European and American models over the years. BYD didn't dismiss the claims, the most safety-critical systems held, and the company's point about physical access may yet turn out to matter. A single demonstration on one vehicle is a warning, not a verdict on every car BYD makes.
Mind the hype. Your pickup doesn't need a password to wipe its own windscreen, but it probably should.
Sources: ABC News, Security Affairs, EV Central, carsales, Electrek, Top Gear, Legislation Tracker, Vehicle Certification Agency, Auto Express