Contact Us
(Image generated by generative AI and reviewed under professional human supervision.)
Connected vehicles are increasingly connected to mobile apps, cloud services, charging networks and other online platforms. These features allow drivers to check battery levels, locate their vehicles, plan journeys and control certain functions remotely.
In Hong Kong, growing vehicle connectivity and app-based services raise cyber risk. Weakness in vehicles, local mobile apps, online accounts, cloud platforms and third-party services can expose personal data or enable unauthorised access to connected features. Because cars increasingly depend on apps and cloud services, such as public charging networks or HKeToll, protection must extend beyond the car itself. Owners should secure vehicle accounts, smartphones, charging and toll services, and transfer digital ownership safely when buying and selling.
Recent security research [1] has shown that weaknesses in cloud-based vehicle systems could allow an authenticated vehicle or account to access functions or data belonging to another vehicle if access controls are not properly enforced. The attack starts with credentials or session data obtained from one vehicle. These are used to connect to the backend as that vehicle. The attacker then changes the target vehicle identifiers in messages sent through MQTT, HTTPS or SMS to test whether the system allows access to another vehicle. If the system checks only that the connection is authenticated, without checking permission to access the requested vehicle, it could allow unauthorised access. This is an important reminder that secure communication alone is not enough. Every request must also be checked to ensure that the authenticated user or vehicle is authorised to access the specific vehicle’s data or functions.
In 2024, researchers found weaknesses in Kia’s dealer systems that could allow an attacker to use a vehicle’s licence plate as a starting point to access the owner’s personal information and gain unauthorised access to connected functions [2]. These included locating the vehicle, unlocking it and starting its engine remotely, without notifying the owner of the access changes. Kia fixed the vulnerabilities by 14 August 2024, and the report stated that there was no evidence of exploitation in the wild. The case shows how weaknesses in online services, backend systems it connected to andaccess controls can affect both vehicle privacy and security, even without compromising the vehicle itself.
This does not mean that all connected vehicles are unsafe. Vehicle owners can reduce their risk by following good cybersecurity practices throughout the vehicle’s lifecycle.
Connected vehicles hold apps, accounts, and sensitive data. Whether you’re selling, buying, renting, or returning a car, take a moment to secure digital access and confirm support. This checklist shows how to transfer ownership safely and what to ask about security to protect your privacy, reduce risk, and avoid surprises.
When selling, buying, renting or returning a vehicle:
Before purchasing a new or used connected vehicle, ask:
If you receive an unfamiliar login alert, see an unknown digital key, notice unexplained changes to vehicle settings or suspect unauthorised access:
Do not attempt to modify or repair safety-related vehicle systems yourself. Seek assistance from the manufacturer or an authorised service centre.
Connected-vehicle security extends beyond the vehicle itself. Vehicle accounts, smartphones, cloud services, charging platforms, digital keys and third-party services all form part of the connected ecosystem.
HKCERT reminds vehicle owners to keep vehicle software up to date, protect connected accounts with strong authentication, remain alert to phishing, review digital access regularly, and securely remove personal data and access rights when selling or returning a vehicle.
Treat your connected-vehicle account and digital key with the same care as your physical car key.
Related Tags
Share with
HKCERT Security Incident Statistics and Cybersecurity Trends in Hong Kong for Q3 2026
5 Nov 2026 1635 Views
Copyright © 2026 HKCERT. All rights reserved
We use cookies to give you the best possible experience on our website. By continuing to browse this site, you give consent for cookies to be used. For more details please read our Cookie Policy.
