FTC Safeguards Rule Penalties: What a Dealership Actually Risks

FTC Safeguards Rule penalties are not the biggest risk to a dealership. The breach is, because a ransomware attack can shut down a store for weeks, while the FTC can’t get a civil penalty for a first violation of the rule.

Last updated: November 12, 2026

I worked my way through college in the service and detail department where my dad was the service manager. A service drive runs on repair orders, and when the systems that hold them go down, the work slows to whatever can be done by hand.

That’s why this post starts with downtime and gets to the penalties second. I’m not a lawyer and none of this is legal advice, but every figure below links to its source, and you’ll see where our dealership cybersecurity services fit in.

What Does a Breach Actually Cost a Dealership?

A breach costs a dealership its working days first. CDK’s 2023 dealership cybersecurity study lists 3.4 weeks as the average downtime after a ransomware attack, citing Veeam’s 2023 ransomware research.

That’s before a regulator, an insurer or a customer asks a single question. If your systems were down that long, it would mean about 24 days of repair orders on paper, parts lookups done the slow way and deals waiting to post, with the people on the floor carrying every hour of it.

The same CDK study cites Coveware’s July 2023 report for an average ransomware payout of $740,144. That’s the figure that makes headlines. The downtime is the part the store lives through.

Nor do you have to be the target. After the hacking and ransomware attack on CDK that began in mid-June 2024, Anderson Economic Group estimated direct losses to franchised dealers at $1.02 billion over three weeks, including about 56,200 lost new-vehicle sales. Those dealers were customers of the vendor that got hit, which is one reason the Safeguards Rule makes you oversee your service providers. Any fine comes after all of that.

Can the FTC Fine a Dealership for a Safeguards Rule Violation?

Not for a first violation. In 2019 the FTC told a Senate subcommittee that when it brings cases under the Safeguards Rule, “it cannot obtain civil penalties for first-time violations.”

The money shows up later. Once a company is under a final FTC order and violates it, civil penalties can run up to $53,088 per violation under the FTC’s January 2025 inflation adjustment, a level the FTC kept unchanged for 2026. Under 15 U.S.C. 45(l), each day of a continuing failure to obey that order counts as a separate offense. That’s a penalty for ignoring an order. It isn’t a penalty for the breach.

The gap isn’t a secret. In a February 2019 report on consumer reporting agencies, the Government Accountability Office noted that the FTC has no civil penalty authority for violations of the Gramm-Leach-Bliley Act’s requirements and suggested Congress consider granting it. GAO’s report page says Congress hadn’t acted as of February 2026.

Different law, different math. I’m not telling you the rule is toothless, I’m telling you the teeth are somewhere else, and Congress could change where they sit whenever it wants to.

Has the FTC Ever Enforced the Safeguards Rule Against a Dealer?

We haven’t found one. The closest case is a 2019 settlement with a dealer software vendor, not a dealership, and FTC dealer enforcement in 2026 has run through advertised prices, fees and add-ons instead. Vendor, not dealer.

That vendor case is LightYear Dealer Technologies, which does business as DealerBuilt. On June 12, 2019, the FTC announced a proposed settlement alleging an unfair practice and a Safeguards Rule violation after a breach exposed personal information on millions of consumers. The final order, approved September 6, 2019, required an information security program, third-party assessments every two years and an annual compliance certification. It included no payment or civil penalty.

The agency hasn’t ignored dealers, though. Here’s where its 2026 attention went, with the dealers described instead of named.

• March 13. Letters went to 97 dealership groups warning that advertised prices must include all mandatory fees. Warnings, not fines.
• On April 2 the FTC and the Maryland attorney general announced a proposed order with a dealer group over advertised prices and add-ons, which includes a $3.1 million civil penalty to the Maryland attorney general’s office and redress for eligible consumers.
• On August 19 the FTC and Connecticut announced a proposed order requiring a dealership to pay $4 million for consumer redress over allegations of fees charged without authorization.

Pricing and fee cases, every one, and they land on the sales desk instead of the server room. Our 2026 dealership enforcement rundown lays out the whole docket in order, so I’ll stay on risk here.

What Else Does a Breach Trigger Besides a Fine?

Deadlines and paperwork, mostly, and they start long before any penalty could. The FTC wants notice no later than 30 days after discovery when unencrypted customer information on at least 500 consumers is acquired without authorization, and every state has its own breach notification law.

• 30 days. That’s the FTC’s notice window for a notification event involving at least 500 consumers, counted from discovery and in force since May 13, 2024 under 16 CFR 314.4(j). Scot McConnor walks through how the FTC breach notice works.
• Customer notices. According to the National Conference of State Legislatures, all 50 states have laws requiring private businesses to notify individuals of breaches involving personally identifiable information. Our dealership privacy laws by state guide covers how those rules differ.
• Do you hold California customers’ data and fall under the CCPA? Then a breach of nonencrypted and nonredacted personal information caused by a failure to keep reasonable security lets those customers seek $107 to $799 each per incident, or actual damages when those are higher, under Civil Code 1798.150.
• Your cyber insurance application. The answers on it can become part of the policy, which is why we wrote about what an honest answer looks like.
• Your automaker. GM and Mercedes-Benz USA are among the OEMs that set their own security standards for franchised stores, and our OEM cybersecurity requirements guide covers what they ask for.
• A written incident response plan, which the rule requires under 16 CFR 314.4(h). Nobody wants to read theirs for the first time mid-incident, so start from our incident response plan template.

None of those waits for the FTC. Not one.

What Protects a Dealership From Both the Criminals and the Regulators?

A working Safeguards program does. The controls the rule requires, from a named owner to multi-factor authentication to trained staff, are the same ones that make a criminal’s job harder.

The rule’s required elements are laid out in our Safeguards Rule requirements guide, and the text itself is 16 CFR 314.4. Here’s the unglamorous version, written for the people who’ll live with it on a Tuesday afternoon between customers.

1. Name a Qualified Individual. The rule requires one person to oversee and enforce the program, and the whole building should know who.
2. Put the risk assessment in writing, because the rule bases the whole program on it. A hallway conversation doesn’t count, however good it was. Our Safeguards risk assessment template is a place to start.
3. Multi-factor authentication for anyone accessing an information system, unless your Qualified Individual approves an equivalent control in writing.
4. Retire the workarounds. A shared login at the parts counter is one, since you can’t control access you can’t trace to a person, and workarounds need to be left in the past.
5. Train the people who touch deals (the rule requires security awareness training), as practice and not a slide deck, because hands on experience and repetition is what actually sticks for an F&I manager or a service advisor.
6. Oversee your vendors. The rule requires you to pick capable service providers, put safeguards in their contracts and assess them periodically.
7. Rehearse the incident response plan once, out loud, with the managers who’d actually run it.

Think of it like a fire extinguisher, since nobody buys one because the fire marshal might visit. You buy it because the building is worth protecting, and the marshal’s visit goes fine as a side effect. Same logic.

Bias disclosed. We sell compliance help, and we benefit when you’d rather not run this alone. But if you already have a named owner, a current risk assessment and a team that’s practiced the plan, you may not need us at all. Helion Technologies manages IT, cybersecurity and compliance for franchised car and heavy truck dealerships. We have 2,000-plus dealerships under management and nearly 30 years in this business, so the Safeguards Rule checklist is a good place to test yourself first. Start there.

Questions Dealers Ask About Safeguards Penalties

The Penalty Is the Smaller Problem

The FTC can’t hand a dealer a civil penalty for a first Safeguards violation, but a breach can still hand it weeks of downtime, a 30-day FTC notice clock and customer notices under state law. That’s the real exposure. It falls on the people on the floor long before it ever reaches a regulator.

Compliance is how you protect the store from both. If you’d like a second set of eyes, our complimentary IT and cybersecurity assessment looks at your technology setup, cybersecurity posture and compliance standing against the Safeguards Rule, and our dealership compliance program runs that work continuously instead of once a year. Set the team up for success now. That’s the real work.