There's stories popping up in the UK, US and Canada recently about this vulnerability.
From a comment in the reddit thread below:
"Thieves are gaining access to the left headlight computer sub-assembly by peeling back the plastic splash guard, where they can stick a couple of pins into the CAN_H and CAN_L wires in the wiring harness plug."