Norwegian transit authority Ruter conducted cybersecurity testing on a Yutong electric bus. The investigation examined whether the vehicle could serve as a surveillance platform or if remote access could interfere with its operations.
Investigators found that the bus's camera systems were isolated from the manufacturer's online network. However, they identified an internet-connected path that could allow remote access to critical vehicle systems, potentially rendering the bus unusable.
The study compared the 2025 Yutong with a 2022 VDL bus. The VDL model lacked significant external connectivity and over-the-air update capabilities, making it an ineffective control for isolating nationality as a security factor.
Ruter possessed newer European electric buses from MAN and Solaris with advanced digital architectures, but did not use them for direct comparison. This prevented a clear assessment of whether the identified risks were specific to Yutong or common to modern connected buses.
Separately, the Danish transit agency Movia commissioned EY to assess cybersecurity maturity across various manufacturers. The report concluded there was no evidence to suggest Chinese buses are less secure than their European counterparts.
