Auto dealership cybersecurity news in October 2026 is mostly about other people’s remote access: a hacked dealer software platform in Germany, an exploited VPN flaw, and a heavy Microsoft patch month. Each item below ends with what a dealer should check.
Last updated: October 17, 2026
A customer gets an email two days before delivery. It has the right order number, the right delivery date, and the exact amount they’re financing. It says the store’s bank details changed and asks them to wire the down payment to a new account. Everything in it is true except the account. The customer pays. Why wouldn’t they?
That’s the scam German police and dealers are bracing for right now, and it’s the reason this month’s news matters to a store in Ohio or Georgia as much as one in Bavaria.
I started on the sales floor in the late ’90s, spent five years selling CRM to dealers, and I’ve been at Helion Technologies for the past 20 years. In all that time the hardest attacks to see coming have rarely started inside the dealership. They start somewhere else. A vendor, a remote tool, a box in the back room nobody remembers owning. So every month I’ll put the public incidents and alerts that touch dealers on this one page, newest month on top, and end each one with the thing I’d check if it were my store. If you want the bigger picture of how we protect stores day to day, our dealership cybersecurity services page covers it.
One rule for the page. Public sources only.
October 2026: Somebody Else’s Door
Three things landed in the first half of October. They rhyme.
A German Dealer Software Platform Was Open for Three Weeks
Between 10:34 p.m. on Sept. 8 and 10:50 p.m. on Sept. 29, someone was logged in to GeNesys, a dealer management platform sold by Achter Autohaus Software, a small company near Würzburg. The provider spotted it on Sept. 30. Three weeks. The vendor’s own reference page claims more than 400 German businesses use the platform, and Volkswagen confirmed that its retail arm, which runs about 120 German stores, is one of them. The details come from dealer notices that a German IT blogger, Günter Born, republished on Oct. 14, and from The Auto Wire’s Oct. 16 report.
What got copied is what makes it nasty. Think about it. Order and invoice numbers, delivery dates, purchase prices, financing amounts, and at some stores the VIN and the salesperson’s name. Names, addresses, phone numbers, and email addresses too. No ransom note, no frozen screens, no service lane gone dark. Just the exact paperwork a scammer needs to sound like your finance office.
One dealer notice says the intruder used login credentials it already had. Police told the German news agency dpa the attack went through third-party software with a serious security flaw. Nobody has tied those two accounts together on the record, and police said they had seen no fraud attempts yet. One dealer group didn’t hear about any of it until Oct. 9. That’s nine days after the provider found it.
What I’d check: how your customers learn where to send money. If the answer is “an email from the F&I office,” put a line on every buyer’s order that says the store will never change payment details by email or text, and that the buyer should call the salesperson at a number they already have. Then ask your DMS and desking vendors one plain question in writing. If you had a breach, how many days would it take to tell us?
Nine days is a long time to be the last to know.
A Remote-Access Appliance Was Attacked Before Anyone Had a Patch
On Oct. 13, Ivanti warned that a flaw in its Connect Secure VPN appliance, CVE-2026-104935, was already being used in attacks, and CISA added it to its Known Exploited Vulnerabilities catalog the same day. According to BleepingComputer, the attackers had been chaining it with two other bugs since at least Oct. 3, getting root access even on devices that were fully patched at the time, rewriting logs as they went, and going after passwords and Active Directory data. Ivanti fixed two of the three flaws in that chain right away. The third was still being worked on when the warning went out.
Plenty of dealer groups don’t run this product. Fine. That’s not really the point. The point is that the box your remote salespeople, your controller, and your outside vendors use to get into the network sits on the internet by design, and it’s the first thing attackers look for.
What I’d check: whether you can name the remote-access device at each rooftop, who patches it, and the date it was last updated. If nobody in the room knows, that’s your answer. Write it down.
Microsoft’s Biggest Patch Month on Record
Microsoft’s Oct. 13 release fixed 1,408 security issues, by Computerworld’s count, up from 963 in September. One Windows flaw was already being exploited. It lets a booby-trapped file or link skip the warning Windows normally shows for things downloaded from the internet, which is exactly the warning a busy service advisor clicks past anyway. CISA gave federal agencies three days to fix it.
Still running your own Exchange server? There’s homework. Microsoft fixed seven Exchange flaws this month, one of them critical, and one of those fixes ships as a separate update that came out on Oct. 2, so a server that took the regular October patch can still be missing it. Installing one set and not the other leaves the door half shut.
What I’d check: that every PC at every rooftop took the October updates, including the parts counter machine that never gets rebooted, and whether that old Exchange box is still answering mail at all.
The month’s quieter item came from a DMS provider’s own annual dealer survey, published Oct. 5. Dealers now name email phishing as their most common security worry, ahead of ransomware. I think they’re right to. Phishing is how a lot of these stories start.
Different vendors, same lesson. The way in was somebody else’s door.
September 2026: The Remote Tool Problem, Down Under
The September story I keep coming back to happened in Australia, and it’s the cleanest example I’ve seen of why I worry less about the dealership’s front door than the side entrance.
Starting Aug. 18, a ransomware group called Storm began posting Australian car dealerships and auto and machinery suppliers on its leak site. At least three of them had one thing in common. Auto-IT, which calls itself one of Australia’s largest DMS companies and serves automotive, truck, agriculture, and construction dealers, told Cyber Daily on Sept. 15 that “a small number” of its customers had been named after “the unauthorised use of a third-party remote monitoring and management tool.” One dealer group said it had reported the incident to Australia’s privacy regulator. The samples the group posted reportedly included customer invoices, employee ID scans, and login credentials. Auto-IT said the incident was contained and that customer systems stayed up and running.
Think about what a remote monitoring and management tool is. It’s the software your IT provider, or your DMS vendor, or the phone company uses to reach into your PCs and fix things without driving over. It runs with a lot of permission. Usually with no one watching it. That’s the problem.
What I’d check: how many remote-support tools are installed on your PCs right now, and who owns each one. Ask before you look, then look, because the two numbers rarely match. Every one of them should require multi-factor sign-in, and every one nobody can claim should come off.
Microsoft’s SharePoint had a rough September too. On Sept. 25, Microsoft revised a SharePoint Server flaw it fixed back in August to say attacks had been seen, and CISA added it to the exploited list the same day. SharePoint Server 2016 and 2019 also left extended support on July 14, so two of October’s SharePoint flaws have no fix at all for those versions. If a dealer group kept an on-premises SharePoint for policies and HR forms, it’s time to move it. Not next year.
And a claim that didn’t hold up. A group calling itself Xpl0itrs said in September that it had stolen about 800 BMW documents, including dealership information. A BlackFog review found some of the files were already public and the samples didn’t back up the bigger claims, and BMW hasn’t confirmed a breach. Leak sites are marketing for criminals. Treat them that way until someone confirms.
The side entrance is where the action was.
This Month at a Glance
If you only read one part of this page, read this table, and hand each row to the person in the second column.
| News item | Who should check | The check |
|---|---|---|
| GeNesys dealer software breach (Germany, Oct.) | F&I director, controller | A printed payment-change warning on every deal, and a written breach-notice timeline from each vendor |
| Ivanti Connect Secure zero-day (Oct. 13) | IT manager or provider | Name the remote-access device at each rooftop, its owner, and its last update date |
| Microsoft October updates (Oct. 13) | IT manager or provider | Every PC patched, both Exchange update sets installed, or the old Exchange server retired |
| Auto-IT remote tool incident (Australia, Sept.) | General manager with IT | Count every remote-support tool on store PCs, require multi-factor sign-in, remove the orphans |
| SharePoint flaw exploited (Sept. 25) | IT manager or provider | Find any on-premises SharePoint 2016 or 2019 and plan its move |
| Phishing tops dealer worries (Oct. 5 survey) | Every department head | One practice phishing email this month, and a quick talk with whoever clicks |
Six rows. Four of them come back to the same question about who else can get in.
Still Worth Knowing From Earlier in 2026
A few earlier stories keep coming up when I sit down with a dealer principal, so they stay on the page.
In April, a multi-store dealer group in Iowa found an intruder in its systems. Phones and computers went down at its stores, phone service was spotty for several days, and a June notice said files could have held customers’ and employees’ Social Security numbers, government ID numbers, financial account details, and passport information. The stores stayed open. I’d underline that. They had a way to keep working, which is exactly what our DMS outage plan guide is about.
The other two were vendor stories. Of course they were. In April, a ransomware group claimed it had taken data in January from a file-transfer system run by a company that serves Nissan and Infiniti dealers across North America. Nissan said the incident was isolated to that vendor and that its own systems weren’t touched, as The Record reported. And in February, CarGurus disclosed an incident that, according to the group claiming it, started with phone calls talking employees into handing over sign-in codes. We wrote up the dealer side of that one in our CarGurus breach post.
For the longer view, the numbers haven’t moved much. One DMS provider’s 2024 study found 35% of dealers had a cyberattack or incident that year, and its 2023 study put average downtime after an attack at 3.4 weeks. Our state of dealership cybersecurity page keeps that history in one place, and our 2026 outlook covers what we expected going into the year.
The headlines change every month. The pattern hasn’t changed in two years.
How This Page Works
Whenever things aren’t going the way I want, I ask myself one question. What am I not doing? It works. This page is my attempt to make that question easier for a dealer to answer once a month.
Here’s the list. Breaches and attacks at dealerships, dealer groups, OEMs, and the software vendors dealers depend on, here and overseas, because a scam that works on car buyers in Bavaria this month can just as easily be tried on car buyers in Texas the next. Disclosures from publicly traded dealer groups on SEC Form 8-K. Breach notices filed with state attorneys general. CISA alerts about flaws in things dealers actually run. We support 2,000-plus dealerships, so we often hear about a vendor problem early, but hearing isn’t a source, and nothing goes up until there’s a public filing, notice, or report I can link for you.
What won’t go on it: guesses about who’s next, rumors from a forum, or the name of any dealership that’s a Helion client. When a dealer group is the victim, I describe the store instead of naming it, the way I’d want somebody to talk about ours. This isn’t legal advice, either. If a specific incident touches your customers’ data, bring your attorney in.
The regulatory side, meaning FTC Safeguards Rule updates, FTC actions, and state breach-law changes, lives on its own page. Our FTC Safeguards Rule news tracker logs those by date.
If you’d rather find out how exposed your own store looks from the outside, our free hackability test is a quick place to start.
Questions Dealers Ask About the News
Why should a U.S. store care about a breach at a German software company?
We don’t use Ivanti. Can we skip that item?
A ransomware group says it has our data. Do we pay attention or wait?
How often does this page change?
Is this the same as your FTC Safeguards news page?
The Short Version
Nothing this month started inside a dealership. Nothing. A software platform in Germany, a remote tool in Australia, a VPN appliance, a Windows warning screen. Each one was a door somebody else built and somebody else was supposed to watch. You can’t control those companies. Nobody can. You can know which of them have a key to your building, and you can make sure each key gets checked. That’s how you get peace of mind out of a month like this one, and it’s the kind of tried-and-true work that lets your people focus on sales and service.
If you’d like help making that list, our complimentary IT and cybersecurity assessment starts with exactly that question, and we’ll walk through it with you rooftop by rooftop.
Know who holds the keys.