BYD Shark security investigation confirmed

BYD Australia has formally responded to the ABC Four Corners program’s report on the unauthorised hacking of a Shark 6 ute, confirming it will conduct an internal investigation into the matter.

In a statement issued under the name of Chief Operating Officer Stephen Collins, an internal investigation into the matter has been confirmed.

“BYD Australia takes vehicle security very seriously for its customers and all road users,” Collins said in a written media statement, which is reproduced in full at the bottom of this story.

The investigation is being conducted by BYD Australia with involvement from teams at its Chinese headquarters. Four Corners is also providing technical information about its test.

carsales understands a public statement about the findings will be made at the conclusion of the investigation. It is also understood BYD will make changes to its systems if required.

As reported by carsales last week, non-critical vehicle functions such as windscreen wipers were hacked by a cybersecurity expert.

The expert, Canberra-based Fortify Labs co-founder Dan Hreszczuk, was then able to remotely operate these functions.

Hreszczuk, who had the Shark 6 for two weeks, was not able to access critical functions such as the brakes or camera system.

However, the report also raised privacy concerns, with Hreszczuk demonstrating how conversations could be monitored remotely, before using recorded audio to trigger voice-assistant functions on a smartphone left inside the vehicle.

“We are taking full and immediate action in reviewing alleged claims made in the Four Corners program relating to unauthorised remote access of certain non-critical vehicle control functions,” Collins said.

“We will respond in detail once we have completed our investigation.

“The safety of our customers and all road users is our absolute priority.”

Collins also addressed the privacy concerns, stressing the issue is a concern across the entire automotive industry.

Currently, Australia lacks dedicated legislation for connected vehicles, relying instead on the broad and ageing framework of the Privacy Act 1988 and voluntary industry codes.

That’s despite security concerns already being raised in Australia about connected cars, especially those from China.

“BYD Australia notes concerns raised about connected vehicle data security in Australia.

“Personal data generated by BYD vehicles in Australia is stored on Australian servers.

“We have publicly called for purpose-built connected vehicle legislation in Australia – a clear, enforceable standard applying equally to every brand in this market.

“We welcome that scrutiny and would comply fully with any such framework.”

The Four Corners hack is the latest in a rapid series of issues for BYD in Australia, most recently including a recall of all Shark 6s sold locally because the spare wheel could detach while driving, and the sale of vehicles manufactured in 2025, including examples of the Shark 6, as 2026 builds.

At the same time, it is rapidly expanding its line-up and aggressively cutting the price of entry to EVs and PHEVs in Australia, with the Atto 1 priced below $20,000 drive-away and the BYD Atto 2 DM-i below $25,000 before on-road costs.

These issues are too fresh to be affecting buyer perception at this point, with sales more than doubling over the past 12 months and BYD sitting second only to Toyota in the overall sales rankings.

Whether they begin to turn buyers away from BYD will only become evident in the coming months.

Vehicle security:

“BYD Australia takes vehicle security very seriously for its customers and all road users. We are taking full and immediate action in reviewing alleged claims made in the Four Corners program relating to unauthorised remote access of certain non-critical vehicle control functions. We will respond in detail once we have completed our investigation. The safety of our customers and all road users is our absolute priority.”

In-vehicle personal data:

“BYD Australia notes concerns raised about connected vehicle data security in Australia. Personal data generated by BYD vehicles in Australia is stored on Australian servers. We have publicly called for purpose-built connected vehicle legislation in Australia – a clear, enforceable standard applying equally to every brand in this market. We welcome that scrutiny and would comply fully with any such framework.”

Join the conversation at our Facebook page
Or email us at editor@carsales.com.au