A controlled hack of a BYD Shark 6 has put connected-car security firmly on Australia’s EV agenda. In an investigation published on Monday, ABC’s Four Corners asked Canberra automotive cybersecurity specialist Dan Hreszczuk to examine the plug-in hybrid ute. After two weeks, he demonstrated remote access to several cabin and convenience systems while the vehicle was driven slowly on a closed, controlled route—an unsettling reminder that the modern car is as much a networked computer as a machine.
What the Shark 6 test revealed
According to the ABC investigation, Hreszczuk could lock the doors, operate the wipers and washer, play audio and images through the infotainment system, and switch the exterior lights on and off. He also accessed the vehicle microphone and location information. Crucially, he said he could not reach protected safety-critical systems such as the brakes or cameras. The demonstration therefore was not a claim that every Shark 6 can simply be commandeered, but it did expose how non-critical functions could still distract a driver or compromise privacy if improperly secured.
The finding matters beyond one model or manufacturer. Connected EVs and plug-in hybrids routinely use cameras, microphones, mobile data and over-the-air software to deliver navigation, remote apps and updates. Those features are useful, but every connection expands the security surface. Hreszczuk told the ABC that the access used in the test did not require a password. BYD said data it collects is stored in Australia and that it has not, and would not, provide Australians’ data to Chinese authorities. The report also noted that Australia currently has no mandatory minimum automotive cybersecurity standard, although the federal government has begun industry consultation on new cyber and software rules.
BYD’s rapid growth raises the stakes
The security debate arrives as BYD pushes hard on affordability. The Driven reported within the past day that the company had cut the Dolphin electric hatch to below $30,000 drive-away in Australia, extending the pressure on rival entry-level EVs. Another fresh report from SmartCompany said Shark 6 vehicles were subject to a recall, adding a separate ownership issue for the popular electrified ute. Recalls and cybersecurity tests are different matters, but together they underline the challenge facing a fast-growing brand: expanding sales while proving that software, support and quality systems can scale just as quickly.
Tesla keeps software at the centre
Tesla, meanwhile, remains the industry’s clearest example of a software-defined vehicle business. WhichCar reported fresh Australian performance statistics for Tesla’s supervised self-driving technology, while Electrek said the company had reopened US$50,000 Roadster reservations ahead of an October 1 reveal. Both stories reinforce how software capability and headline technology continue to shape EV competition. They also highlight why transparent safety data, strong access controls and rapid security updates are becoming major buying considerations alongside range, charging speed and price.
For EV enthusiasts, the takeaway is not to abandon connected cars; it is to demand better safeguards. Buyers should keep vehicle software and linked phones updated, use strong unique passwords for manufacturer accounts, enable multi-factor authentication where available and review app permissions. Carmakers and regulators must do the heavier work: secure systems by design, isolate safety-critical controls, establish clear data rules and provide long-term patching. The next phase of the EV race will be judged not only by kilometres of range or dollars off the sticker, but by how safely each car handles the data and control entrusted to it.