Loading story…
European public transport operators in the UK, Norway, and Denmark are investigating cybersecurity vulnerabilities in Chinese-made Yutong electric buses, following concerns that the manufacturer could remotely access and potentially disable vehicles. The UK government, in coordination with the National Cyber Security Centre, is assessing the risk after Norwegian operator Ruter identified that Yutong has direct digital access to each bus for software updates and diagnostics, including critical systems like battery and power management. Operators have implemented measures such as disconnecting buses from the internet to retain local control, while the UK Department for Transport has acknowledged the seriousness of the issue and is working with intelligence agencies to mitigate potential risks.
Simultaneously, Danish and Norwegian transport providers are urgently probing the same security flaw, highlighting broader European fears about reliance on Chinese technology and the risk of remote tampering or control amid geopolitical tensions. Yutong, the world’s largest bus manufacturer, has stated that it complies with all safety and data privacy standards, storing EU vehicle data securely and requiring customer authorization for system access. The investigations underscore the potential for remote deactivation of connected vehicles and the need for robust cybersecurity measures in critical public infrastructure.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
The UK moved to have its cyber and intelligence services investigate claims that Chinese-made buses could potentially be switched off remotely. The step expanded official scrutiny of the Yutong bus security issue beyond Denmark and Norway.
Operators and authorities in Norway and Denmark began testing the affected buses and putting fixes in place to reduce the risk associated with the remote-access functionality. These actions were reported as part of the response to the disclosed security concern.
Authorities in Denmark and Norway launched investigations into a vulnerability in Chinese-made Yutong electric buses that could allow remote diagnostics and software updates to be abused to interfere with or disable vehicles. The issue raised concerns about the use of connected Chinese technology in critical transport infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has launched an investigation into whether over 2,500 Chinese-manufactured Yutong electric buses operating in the country could be remotely disabled by their manufacturer. This probe was initiated after authorities in Norway and Denmark discovered that similar Yutong buses in their countries had SIM-enabled telematics systems, which allowed for remote control of critical functions such as battery and power, raising concerns that the vehicles could be stopped or rendered inoperable from afar. The Department for Transport and the National Cyber Security Centre are leading the assessment to determine if UK buses are exposed to the same vulnerabilities. The investigation follows reports that Norwegian and Danish authorities found remote diagnostic and control capabilities in these buses, potentially exposing vehicle controls to unauthorized access. The UK is now evaluating the risk that these remote-access features could pose to public safety and national infrastructure, particularly if exploited by a malicious actor or during geopolitical tensions. The findings could have significant implications for the security of critical transportation assets and the procurement of foreign-manufactured vehicles with embedded telematics technology.
Jun 29, 2026
Dark Reading reported on several region-specific cyber-risk themes rather than a single discrete incident. The World Economic Forum’s *Global Cybersecurity Outlook 2026* found **Latin American and Caribbean organizations have the lowest confidence** in their countries’ ability to defend critical infrastructure (13% confident vs. 37% globally), citing under-resourced cyber-resilience and incident-response capabilities as digital infrastructure expands. Separately, a Dark Reading commentary described **growing European anxiety about overreliance on US technology and cybersecurity vendors**, framing it as a strategic and sovereignty concern rather than a specific breach or vulnerability disclosure. Australia also opened a national-security review into **Chinese-made Yutong electric buses** deployed in major cities, following researcher reporting that the vehicles’ connectivity and remote-management features could be abused and that a “kill switch” scenario is a perceived risk in a crisis (the article notes the reality is more complex than the headline framing). A ZDNET leadership piece echoed the broader theme that **technology and cybersecurity decisions are increasingly treated as national-security bets**, but it is largely strategic guidance and executive commentary rather than actionable threat intelligence.
Jun 29, 2026
European officials and industry reporting have highlighted a widening threat to critical infrastructure as cyber risks to electricity networks grow alongside military monitoring of subsea assets. An International Energy Agency assessment cited in Spanish reporting said cyberattacks on critical energy infrastructure rose 30% in 2023 to **420 million** globally, while attacks on energy service companies have quadrupled since 2020. Recent incidents include the 2022 satellite communications disruption that knocked **5,800 wind turbines** offline in Germany and breaches affecting more than 20 Danish energy companies. Authorities have also warned that compromised smart meters, solar inverters, and battery systems could be used to destabilize grid frequency or trigger broader outages. The concern extends beyond direct hacking to supply-chain and geopolitical exposure tied to digitally connected clean-energy equipment and other strategic infrastructure. European and U.S. authorities reviewed communications modules in imported solar and battery systems, while Lithuania moved to block remote access by Chinese suppliers to solar, wind, and storage control platforms. Separately, the UK said British and Norwegian forces carried out a month-long operation to track a Russian attack submarine and two GUGI-linked spy submarines near North Atlantic cables and pipelines, underscoring fears that hostile states could target the seabed networks that carry **99% of international telecommunications traffic** and support a major share of regional energy supplies.
Jun 29, 2026