Browse
Log in / Register
Share
Date: April 26, 2026
A security researcher in Australia commandeered a BYD pickup without breaking a sweat, reigniting the debate over how much data Chinese electric vehicles collect and how thin their digital shields really are. The test—aired by ABC News—came right after an Xpeng insider allegedly handed over vehicle telemetry showing position, speed, seat occupancy, and steering angle. For American drivers, the takeaway is blunt: the internet-connected car you park in your garage may be far less private than the dashboard suggests.
The most striking part of the investigation centered on a BYD Shark 6 that was handed to Dan Hreszczuk, a cybersecurity researcher who specializes in cars. He was given just two weeks to find a weak spot. He found one almost immediately—and it was embarrassingly basic.
“The access we took advantage of didn’t even have a password,” Hreszczuk told the program.
Once inside, he could lock the driver inside the cabin, blast music through the speakers, and flick the wipers and lights on while the truck was moving. Annoying, sure. Potentially dangerous, definitely. But then things got deeply uncomfortable: Hreszczuk tapped into the vehicle’s interior microphones and listened in on a journalist’s phone call. He even recorded the journalist’s voice, isolated the “Hey Siri” wake phrase, and played it back through the truck’s audio system. The iPhone dutifully woke up, executed a set of Hreszczuk’s own follow-up commands, and spilled out personal data—including the owner’s date of birth, phone number, and contacts. One of those contacts happened to be the office of Australia’s prime minister. The implication isn’t just that someone can mess with your sunroof; it’s that your car can become a remote listening device and a gateway to every other device you own.
The investigation also looked hard at Xpeng, another major Chinese EV player. ABC News obtained an Xpeng G6, and a company insider reportedly showed them a dashboard that could track the vehicle in real time. Location, speed, seat occupancy, even the angle of the steering wheel were visible. That kind of data isn’t just useful for parking lot tracking; it paints a detailed portrait of where you drive, when you drive it, who sits next to you, and how you behave behind the wheel.
What made the finding worse, according to the report, was that the data was accessible not only in Australia but also in China. That raises a question many governments are already asking: if the car is a delivery system for personal telemetry, what stops that flow from ending up with the Chinese state?
Australia’s security services have warned public servants not to hold sensitive conversations inside connected cars and not to plug work devices into them. That’s a remarkably practical admission: the carmakers themselves might not be hostile actors, but the data pipeline can be tapped, misused, or subpoenaed under the legal rules of another country.
Australian trade minister Don Farrell drives a BYD Shark 6, and climate change minister Chris Bowen uses an Xpeng G6. Whether those vehicles pose a national security risk has become a political question, not just an engineering one.
Other governments have moved faster. The United Kingdom and Poland have already banned Chinese cars from sensitive sites. British lawmakers noted last year that Chinese law gives authorities legal access to data pulled from vehicles built with Chinese hardware and software. In the United States, Washington hasn’t issued a blanket ban on Chinese EV brands for private citizens—mostly because most of them aren’t officially sold here. But the Commerce Department has finalized restrictions on Chinese and Russian connected-vehicle technology for future models, citing the same kind of espionage and remote-access concerns highlighted in Australia.
Here’s the uncomfortable part: Chinese EV makers didn’t invent invasive vehicle data collection. They’re just efficient at it.
A 2023 Mozilla study examined 25 major car brands and slapped every single one with its “Privacy Not Included” label. Automakers were criticized for hoovering up location history, voice recordings, biometric data, and even inferred moods. The study also found that 84% of those brands admitted to sharing owner data with third parties. Nissan and Kia were flagged for tracking drivers’ “sexual activity” or owners’ “sex life,” according to the report.
Hackers have also shown repeatedly that vulnerability is a universal problem. Security researchers have taken over Teslas, Kias, and Subarus using simple tricks, sometimes just by knowing a VIN or a phone number. The difference with Chinese EVs isn’t necessarily that they’re “hackable.” It’s that the scale of data collection is massive, the legal protection for foreign buyers is shaky, and the national security stakes are more visible.
With BYD and Xpeng not yet available in most American showrooms, US drivers might feel detached from this story. But that misses the point. Chinese-made components are already in many connected vehicles sold around the world, and every major automaker is embedding the same kind of always-on microphones, cameras, and data processors in its cars.
Don’t assume a non-Chinese badge means privacy. Check the privacy policy, disable what you can, and treat any connected car as what it is: a computer with wheels and a microphone. That’s not a reason to panic, but it is a reason to demand more transparency from every automaker.
The Australian investigation should be a wake-up call—not just about BYD and Xpeng, but about an entire industry that treats your driving data as raw material. The cars we love may be getting smarter, but the people watching them are getting smarter too.
