Electric bus security concerns rise as Denmark investigates Chinese-made vehicles

Electric bus security now sits at the center of a national review in Denmark after regulators flagged potential risks in Chinese-made public transport vehicles. Authorities want to determine how remote-management functions, software access routes, and connected subsystems may expose the country’s bus network to cyber-physical threats. This examination reflects a growing global concern about modern fleets that rely on extensive connectivity, vendor-controlled diagnostics, and continuous remote updates.

Denmark launches targeted investigation

The investigation began after disclosures in Norway revealed that certain electric buses contained remote-control functions that allowed the manufacturer to stop or disable vehicles. Danish regulators saw this as a potential red flag because several local operators rely heavily on similar models.

Movia, Denmark’s largest public-transport operator, runs hundreds of buses produced by Chinese manufacturers. Many of these buses use integrated systems for diagnostics, route planning, telemetry, and predictive maintenance. These capabilities support daily operations, but they also introduce channels that attackers could exploit. Authorities now assess each subsystem to understand possible points of compromise.

Risks highlighted by the review

The current review focuses on electric bus security across multiple layers of technology. Regulators are evaluating the ability of connected components to receive commands, transmit data, or access privileged operational settings. These elements include telematics units, GPS modules, cameras, microphones, and over-the-air update tools.

Officials stress that no hostile action has taken place in Denmark. Still, the presence of remote-control functionality, regardless of vendor, introduces a scenario where an attacker might disrupt transportation networks. Remote stopping, forced resets, or targeted system failures could create major safety issues.

Manufacturer stance and remaining questions

Manufacturers claim that collected data remains encrypted and stored within the EU to support maintenance and fleet optimisation. They also state that remote-access tools exist for legitimate servicing purposes. Regulators acknowledge these points but maintain that any connected pathway capable of issuing commands must undergo strict review.

The real issue centers on oversight. Operators must understand how much control vendors retain, how updates are deployed, and which privileges exist in each subsystem. electric bus security depends on limiting unnecessary access and enforcing strict governance around remote management.

Why this issue extends beyond Chinese buses

Danish officials highlight that the concern reaches far beyond one country or one brand. Most modern vehicles rely on electronics sourced from global supply chains. They also depend on internet-connected modules for daily operations. That combination expands the attack surface and increases the importance of auditing every component.

This investigation therefore serves as a test case for broader transport cybersecurity strategy. As fleets electrify, remote-service functions grow. These functions bring efficiency, but they also create new liabilities that demand tighter controls.

What happens next

Regulators plan to carry out technical assessments, interview operators, and map all access points within the affected buses. They may introduce new procurement rules, new monitoring requirements, or strict limits on vendor-controlled features. Operators will likely adopt clearer guidelines for remote-access rights and implement reinforced logging, segmentation, and update oversight.

Conclusion

Denmark’s investigation into electric bus security marks a pivotal moment for modern public-transport safety. The review highlights how connected subsystems, remote-management functions, and opaque supply chains introduce real risks that cannot be ignored. As authorities continue their assessment, the case underscores a broader truth: the shift to connected and electrified fleets must come with strong cybersecurity controls and transparent vendor relationships. Sustainable mobility depends on it.