Two researchers may have just proved connected cars can be unlocked, started from thousands of miles away

Disclaimer: Its an AI-generated image used for representative purpose only In early 2026, two security researchers demonstrated that hackers could remotely unlock the doors and start the engines of internet-connected cars from anywhere in the world.

Working together, white-hat hackers Shubham Shah and Sam Curry breached the backend connectivity systems of two major automakers.

Shah and Curry have not publicly named either company.

Inside the connected-car security flaws According to the researchers’ write-ups, both companies relied on ForgeRock for user authentication and authorisation.

Aside from one minor exception, the breaches weren't caused by ForgeRock itself but rather by how poorly the automakers implemented it.