According to the ABC ' s reporting, Hreszczuk had physical access to the vehicle for approximately two weeks and identified digital access that was not password-protected. During the demonstration, he reportedly accessed functions including door locking, headlights, wipers, washers and the infotainment system. He was also reportedly able to access the vehicle ' s microphone and track its location.
The investigation reported that more safety-critical functions, including the brakes and cameras, could not be accessed.
BYD Australia said it was investigating how the access had been achieved and whether the issue extended beyond the vehicle tested. The company also questioned the circumstances of the demonstration, including whether additional hardware had been connected to the vehicle. BYD said it was taking immediate action to investigate the claims.
The demonstration highlighted the potential consequences of weaknesses in connected vehicle systems, but it did not establish that every BYD vehicle, or every connected vehicle, was vulnerable in the same way.
The ACSC has separately warned that connected vehicles can be exposed to unauthorised access, privacy breaches and remote interference. Internet-connected vehicle services may allow legitimate users to lock or unlock doors, adjust climate settings or view vehicle information through mobile applications. If access controls or connected systems are compromised, some of these capabilities may also present opportunities for misuse.
The risks are not limited to the vehicle itself. Mobile applications, cloud services, user accounts and connected devices can all form part of the system. A weak password or compromised account may create a different risk from a software vulnerability in the vehicle.
Consequences could include unauthorised access to vehicle data, disruption to operations, exposure of employee information or interference with connected functions. The severity of any incident would depend on the specific vulnerability and the systems affected.
Cybersecurity therefore needs to be considered throughout a vehicle ' s working life, not just when it first enters service.
Who is responsible for protecting connected vehicles?
The recent debate has highlighted a gap between the growing complexity of vehicle technology and the information available to consumers and industry.
The Australian Automotive Aftermarket Association
( AAAA) has called for connected vehicles to be explicitly addressed in Australia ' s privacy reforms. Its proposals include stronger consent requirements, improved protections for passengers and secondary drivers, clearer rights around deleting vehicle data and ongoing manufacturer responsibility for software security.
The association has also called for secure mechanisms that allow vehicle owners to authorise independent repairers or data intermediaries to access diagnostic information needed for a particular repair.
The Australian Automotive Dealer Association( AADA) has separately called for clearer information about connected vehicle technology, data collection and cybersecurity. It argues that manufacturers and regulators should provide the information needed to answer customers ' questions, rather than leaving dealers to explain systems they do not control.
These concerns extend beyond privacy. Vehicle manufacturers develop and maintain connected systems, dealers explain vehicle features to customers, repairers need diagnostic information, and regulators oversee relevant legal and safety requirements.
Australia already has a Motor Vehicle Service and Repair Information Sharing Scheme, administered by the Australian Competition and Consumer Commission( ACCC). The scheme requires manufacturers and other data providers to make specified service and repair information available to eligible independent repairers and registered training organisations on fair commercial terms.
The scheme helps address access to repair information, but it should not be confused with a general right to access all connected vehicle data. Diagnostic information, personal information and security-sensitive data can have different access requirements.
The ability to access data needed to maintain vehicles should be balanced with appropriate controls to protect personal information and prevent unauthorised access to security-sensitive systems.
Clearer information from manufacturers, stronger security practices and appropriate regulatory oversight will be important to building confidence in connected vehicles.
What fleet managers should do
Connected technology does not need to be avoided, but it should be managed as part of a fleet ' s broader safety, privacy and cybersecurity strategy.
Understand what each vehicle collects. Before purchasing or deploying connected vehicles, review manufacturer privacy policies and connected-service
10 ISSUE 61 OCTOBER 2026 / WWW. AFMA. ORG. AU