Cybersecurity for Car Dealerships: Threats and Defenses

Why Dealerships Are Targeted?

What we tell clients is that understanding your threat profile is the first step toward building an effective defense. Dealerships face a unique combination of factors that make them attractive targets.

The Data Problem

Every vehicle sale generates a dense packet of sensitive data. In our experience, dealerships routinely collect and store the following categories of personally identifiable information:

The F&I department is the single richest data target in the dealership. A compromised F&I system gives an attacker everything they need to commit comprehensive identity theft against every customer who has financed a vehicle.

The Technology Problem

What we see across dealership environments is an over-reliance on a small number of Dealer Management System providers combined with a patchwork of loosely integrated third-party tools. The typical dealership technology stack includes a DMS (CDK, Reynolds and Reynolds, or Dealertrack), a CRM system, desking and F&I software, inventory management tools, manufacturer portals, lender portals, and various marketing platforms. Each of these systems may have different security configurations, different access controls, and different data handling practices.

In our experience, very few dealerships have a unified view of their technology risk.

The People Problem

Dealerships have high employee turnover, particularly in sales roles. What this means from a cybersecurity perspective is that access credentials are frequently shared, former employees often retain access to systems longer than they should, and security awareness training — if it exists at all — is inconsistent. Sales staff routinely handle sensitive customer documents, often on personal devices or shared workstations with minimal access controls.

What can dealerships learn from the CDK disruption?

The CDK Global ransomware attack in June 2024 was a watershed moment for automotive retail cybersecurity. The impact was devastating: dealerships could not process sales, service departments could not access repair orders, and F&I operations ground to a halt. Some estimates put the total industry losses in the hundreds of millions of dollars range, though the full impact was substantial across the industry.

What we tell clients about the CDK incident is that it exposed three critical vulnerabilities that every dealership needs to address.

Single-vendor dependency. Most dealerships had no contingency plan for a DMS outage. When CDK went down, they had no way to process transactions. What we recommend is that every dealership develop a business continuity plan that specifically addresses DMS unavailability, including manual processes for sales, service, and F&I operations.

Third-party risk management failure. Very few dealerships had ever conducted a security assessment of CDK or their other technology vendors. The assumption was that a company that large must have adequate security. In our experience, vendor size does not correlate with vendor security maturity as closely as people assume. We recommend that dealerships include cybersecurity requirements in their vendor contracts and conduct at minimum an annual review of critical vendor security posture.

Incident response unpreparedness. When the CDK systems went down, most dealerships had no incident response plan. Staff did not know what to do, who to contact, or how to communicate with customers. What we recommend is that every dealership have a documented incident response plan that includes specific scenarios for DMS outages, ransomware events, and data breaches.

What does the FTC Safeguards Rule require dealerships to address?

The Federal Trade Commission's revised Safeguards Rule, which went into full effect in June 2023, applies to all financial institutions — and that includes car dealerships because they extend credit through financing arrangements. This is not optional. It is a legal requirement with real enforcement teeth.

What we tell dealership clients is that the Safeguards Rule is actually a reasonable cybersecurity framework if you take it seriously. Here is what it requires:

Core Requirements

Common Compliance Gaps

In our experience working with dealership groups, the most common Safeguards Rule compliance gaps are:

No designated Qualified Individual. Many dealerships assume their IT person or IT vendor fills this role, but the Safeguards Rule requires a specific designation with clear responsibilities. What we recommend is formally designating this role in writing, whether it is an internal employee, an outsourced CISO, or a managed security provider.

No documented risk assessment. The risk assessment cannot be a checkbox exercise. It must identify specific risks to customer information, evaluate the sufficiency of existing safeguards, and document how identified risks will be addressed. In our experience, dealerships that conduct a thorough risk assessment almost always discover vulnerabilities they did not know existed.

Weak access controls. The Safeguards Rule requires multi-factor authentication for anyone accessing customer information. What we see is that many dealerships still use shared logins for DMS systems, have no MFA on critical applications, and have not implemented role-based access controls that limit employees to only the data they need.

No encryption. Customer data must be encrypted both in transit and at rest. Many dealerships store unencrypted customer files on network drives, transmit credit applications over unencrypted connections, and have no encryption on endpoint devices.

DMS System Security

Your Dealer Management System is the backbone of your operation and the most critical system to secure. Whether you use CDK, Reynolds and Reynolds, Dealertrack, or another platform, the security fundamentals are the same.

What we recommend for DMS security:

Implement individual user accounts. Shared DMS logins are one of the most common security failures we see in dealerships. Every employee who accesses the DMS should have a unique account with a strong password and MFA enabled. This is not just a security best practice — it is required by the Safeguards Rule and it gives you an audit trail for who accessed what data and when.

Configure role-based access. Not every employee needs access to every function. Sales staff do not need access to accounting functions. Service advisors do not need access to F&I customer credit data. What we recommend is mapping each role in the dealership to the minimum DMS access required for that role and configuring the system accordingly.

Monitor DMS activity. Enable logging for sensitive operations — credit pulls, deal jacket access, financial record exports, and administrative changes. Review these logs regularly for anomalous activity. In our experience, dealerships that implement DMS activity monitoring catch unauthorized access attempts within days rather than months.

Secure DMS integrations. Your DMS connects to manufacturer systems, lender portals, credit bureaus, and various third-party tools. Each integration is a potential attack vector. What we recommend is auditing every DMS integration, confirming that each uses encrypted connections, and disabling any integrations that are no longer in use.

Vendor Management for Dealership Software

The average dealership uses fifteen to twenty-five different software applications. Each vendor represents a potential security risk. The CDK attack demonstrated what happens when a critical vendor is compromised, but the risk extends to every vendor in your ecosystem.

What we recommend for dealership vendor management:

Inventory all vendors. Create a complete list of every software vendor, SaaS application, and third-party service that has access to your dealership data or systems. Reconcile the supplier inventory with purchasing records, system access, and department workflows to identify missing providers.

Classify vendors by risk. Not all vendors require the same level of scrutiny. We recommend classifying vendors into tiers:

Include security requirements in contracts. Every vendor contract should include data protection requirements, breach notification obligations, and the right to audit or request security documentation. What we tell clients is that if a vendor will not agree to basic security terms, that tells you something important about their security posture.

Employee Training for Dealership Environments

Generic cybersecurity training does not work well in dealership environments. What we have seen is that training programs designed for office workers miss the specific risks that dealership employees face.

What we recommend is dealership-specific training that covers:

Phishing awareness tailored to automotive. Dealership employees receive phishing emails disguised as manufacturer communications, lender notifications, customer inquiries, and inventory alerts. Training should use examples that reflect what dealership staff actually encounter, not generic corporate phishing scenarios.

Customer data handling. Sales and F&I staff handle physical and digital copies of extremely sensitive documents every day. Training must cover secure document handling — no leaving credit applications on desks, no emailing Social Security numbers, no storing customer documents on personal devices, and proper disposal of physical documents.

Social engineering recognition. Dealership employees are conditioned to be helpful and accommodating — it is part of the sales culture. This makes them particularly vulnerable to social engineering attacks. Training should address phone-based pretexting (someone calling and pretending to be from IT support or a lender), in-person social engineering, and business email compromise targeting the accounting or F&I departments.

Reporting procedures. In our experience, employees who suspect something is wrong often do not report it because they do not know who to tell or they are afraid of getting in trouble. Training must clearly communicate the reporting process and emphasize that reporting suspicious activity is encouraged and will not result in negative consequences.

Cyber Insurance for Dealerships

What we tell dealership clients is that cyber insurance is not optional — it is a critical component of your risk management strategy. The costs associated with a dealership data breach — forensic investigation, customer notification, credit monitoring, legal defense, regulatory fines, and business interruption — can easily reach six or seven figures.

What to Look for in a Dealership Cyber Policy

Getting Better Rates

In our experience, dealerships that can demonstrate the following to their cyber insurer consistently receive better rates and broader coverage:

What we recommend is treating cyber insurance underwriting as a security audit. The questions insurers ask are a reasonable checklist of security fundamentals that every dealership should have in place regardless of insurance requirements.

Practical Security Improvements: Where to Start

For dealerships that are starting from scratch or have significant gaps, here is the prioritized action plan we recommend:

Phase 1: Immediate Actions (First 30 Days)

1. Designate your Qualified Individual under the Safeguards Rule
2. Enable MFA on all DMS, CRM, email, and lender portal accounts
3. Eliminate shared login credentials — every employee gets a unique account
4. Conduct an initial inventory of all software vendors and data flows
5. Secure physical access to F&I offices and any areas where customer documents are processed

Phase 2: Foundation Building (Days 30-90)

1. Conduct a formal risk assessment covering all systems that handle customer data
2. Implement role-based access controls on your DMS and other critical systems
3. Deploy endpoint detection and response software on all workstations and servers
4. Enable encryption on all endpoint devices and verify encryption on data at rest
5. Develop your incident response plan with dealership-specific scenarios
6. Begin dealership-specific security awareness training for all employees

Phase 3: Program Maturity (Days 90-180)

1. Implement DMS activity logging and monitoring
2. Conduct your first vendor security assessment for critical and high-risk vendors
3. Develop your business continuity plan including DMS outage procedures
4. Schedule a penetration test or vulnerability assessment
5. Conduct a tabletop incident response exercise
6. Establish your annual compliance calendar for ongoing Safeguards Rule activities

Phase 4: Continuous Operations (Ongoing)

1. Quarterly access reviews across all critical systems
2. Annual risk assessment updates
3. Annual penetration testing or vulnerability assessments
4. Ongoing employee training with quarterly phishing simulations
5. Annual vendor re-assessments for critical and high-risk vendors
6. Annual report to ownership or board from the Qualified Individual

AICPA & CIMA’s SOC overview describes CPA assurance services. It defines the assurance context; it does not establish vendor rankings, market prices, or a particular company’s readiness.