BYD Shark 6 Hack Exposes Critical Security Flaws in Connected Cars A recent cybersecurity test revealed alarming vulnerabilities in the BYD Shark 6, a connected electric vehicle (EV), demonstrating how easily hackers could remotely control critical functions and access sensitive data. Conducted by ABC’s *Four Corners and cybersecurity researcher Dan Hreszczuk of Fortify Labs, the two-week investigation took place in Canberra, Australia, in September 2026*, with a real-world demonstration on a rural road outside the city. Hreszczuk, who specializes in car security, gained unrestricted remote access to the vehicle’s systems through an unprotected entry point no password or security measures were in place. During the test, he locked the doors, blasted music, displayed images on the infotainment screen, and manipulated the windshield wipers, headlights, and water spray while the car was in motion. Most critically, he disabled the headlights entirely, creating an immediate safety hazard for the driver. While the brakes and cameras remained secure, the hack exposed the potential for catastrophic outcomes such as an attacker disabling lights or wipers at high speeds on a dark, winding road. However, the surveillance risks proved even more concerning. Hreszczuk tracked the vehicle’s real-time location and activated the cabin microphone, capturing private conversations. In one instance, he recorded a journalist’s voice saying "Hey Siri" and later replayed it to trick the phone into revealing personal details, including an internet banking password, home address, and contact information. The test underscored regulatory gaps in Australia, where connected cars face no mandatory cybersecurity standards unlike appliances like washing machines. BYD, a Chinese manufacturer, is not required to patch software vulnerabilities or implement risk management systems for its vehicles. While BYD claims Australian customer data remains in Australia and denies sharing information with Chinese authorities, experts note that China’s national security laws could compel cooperation, raising concerns about state-backed surveillance. The incident has sparked debate over government and military policies. The UK banned Chinese-made EVs from sensitive sites last year, while Australia’s ASIO has warned officials against discussing classified matters in such vehicles. Despite this, Trade Minister Don Farrell publicly drives the same BYD Shark model, calling it his "best ute ever" a statement that drew scrutiny given the hack’s timing. Australia is now consulting on new cybersecurity rules for cars, but enforcement remains years away. Until then, the BYD Shark 6 hack serves as a stark reminder of the risks posed by unsecured connected vehicles, where remote access could enable sabotage, espionage, or data theft all with minimal effort.