Hyundai keyless entry exploit

In August 2025, a flaw was discovered in the security of Hyundai's wireless communications protocol, which allows hackers with a "Game Boy-style" device to access the Ioniq 5 and gain physical access to the vehicle without the owner's consent. Hyundai is offering to fix this flaw in their production software for customers who pay a £49 charge.

Background

Keyless entry systems and push-button start systems in cars are becoming increasingly prevalent, offering drivers greater convenience and enhanced features like remote start. While these systems enhance the user experience, they have also introduced new security challenges, with criminals developing ways to exploit vulnerabilities. These systems have long been vulnerable to relay attacks, a broader issue in the automotive industry documented by security researchers. Previous incidents (e.g., Kia “USB hacks” and BMW relay thefts) illustrate a systemic security problem across the industry.

Incident

Change this section's title to be descriptive of the incident.

Impartial and complete description of the events, including actions taken by the company, and the timeline of the incident coming to the public's attention.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

Hyundai's response

Hyundai put out a statement on their website:

All vehicles produced by Hyundai are developed and certified in accordance with all applicable security and regulatory standards in place at the time of production and sale, including the applied security systems installed.

Recently, evolving security threats, including the use of unauthorised electronic devices to bypass vehicle locking systems have become more prevalent in the UK. This is an industry-wide issue and Hyundai is providing appropriate responses in line with industry practices.

As part of the Company’s commitment to supporting our customers, we are able to offer a subsidised software and hardware upgrade for a customer contribution of £49.

Hyundai’s statement frames the £49 charge as part of their “commitment to supporting customers,” describing the fix as a “subsidised upgrade.” However, this phrasing shifts attention away from the underlying issue—that customers are being asked to pay to address a security vulnerability in the company’s product. While the cost may be reduced, the language used makes it less clear that responsibility for the expense has been placed on owners rather than covered by the manufacturer.

Consumer response

Many consumers have expressed sharp frustration and disillusionment over Hyundai's handling of the Ioniq 5 keyless theft vulnerability. One notable case involves a digital security expert, whose Ioniq 5 was stolen in under 20 seconds using a handheld emulator device disguising itself as a Game Boy. The owner says Hyundai had warned him of other modifications the vehicle required, but failed to alert him and other motorists that its security systems were compromised.