FTC Safeguards Rule news for dealers in 2026 has come from breaches, vendor incidents, and FTC paperwork, not new rule text. The requirements haven’t changed since May 2024. This page logs each update by date, with what it means inside the store.
Last updated: October 15, 2026
Most Safeguards news doesn’t arrive as news. It shows up as a letter.
Sometimes it’s from a credit vendor. Customer records went out a side door you didn’t know existed. Sometimes it’s a forwarded article in the general manager’s inbox with “are we OK?” typed above it. And sometimes it’s a phone call from the F&I office because a customer just asked why they got a breach notice with your store’s name in it.
I’ve spent more than 10 years in this industry, on the service drive, in parts and service roles, and then on the software side building training for dealership staff. The rule itself is rarely the surprise. The surprise is what happened to somebody else’s systems, and how fast it turned into your problem. That part catches good stores off guard.
So this is a running log. One entry per development. The date, the source, and what it changes for the people on the floor. We’ll add to it every month. If you want the full explainer instead, our breakdown of the nine Safeguards Rule requirements covers that, and our dealership cybersecurity services page explains how we run the security side day to day.
Think of this page the way a good service advisor thinks about a recall lookup. You check it before the customer is in the chair. Not after.
The 2026 Log, Newest First
I put the newest items at the top so you don’t have to scroll to find out what changed since you last looked. Every row links to where we found it, and if a dealership was involved we just describe the store, the way we’d want somebody to describe one of ours.
| Date | What happened | What it means at the store |
|---|---|---|
| Oct 26, 2026 (upcoming) | Comment deadline on the FTC’s request to keep the Safeguards breach-reporting requirement running for three more years (Federal Register notice) | Nothing to file. The 30-day reporting duty stays in place while the FTC renews it. |
| Aug 25, 2026 | The FTC said it received about 163 breach notifications in 2025, the first full year of the reporting rule, and asked to extend the paperwork clearance that expires Dec 31, 2026 (91 FR 54872) | That count covers every non-bank financial institution the FTC oversees, not only dealers. Your report would sit in a small pile. |
| Mar to Oct 2026 | The FTC sent warning letters to 97 dealership groups on Mar 13, then settled pricing cases with dealer groups in April, August, and October and published price transparency FAQs on Sep 15 (FTC automobiles page) | These are advertising and pricing actions, not Safeguards cases. They tell you the agency is paying attention to dealers again. |
| Feb 2026 | CarGurus disclosed a cybersecurity incident. The group claiming it said it talked employees out of single sign-on codes by phone, and the leaked records reportedly included finance application details (Security Affairs) | A lead and listing source isn’t your system, but the shoppers in it are your customers. Our CarGurus breach post covers the follow-up. |
| Jan 1, 2026 | Oklahoma’s amended breach law took effect. Breaches touching 500 or more residents now go to the state attorney general within 60 days of notifying people (Covington, Inside Privacy) | One breach, two clocks. The FTC wants your report within 30 days of discovery, and the states keep their own deadlines. |
Nothing on that list rewrote the rule. Not one item. Every one of them still changed what a dealer should check, and when I walk a store through it, the checks keep landing on the same three or four people in the building.
Carried Forward From Late 2025
Three things from last year still drive most of the questions we get. So they stay.
The biggest one is 700Credit. Attackers got into one of its integration partners in July 2025, found a connection that could pull customer records, and used it until 700Credit spotted the activity on Oct 25, 2025. The exposed records were ones collected from May through October. More than 5.8 million people were affected, according to SecurityWeek, with names, addresses, birth dates, and Social Security numbers in the mix, and about 18,000 dealerships use the company. F&I managers ask about the next part first. NADA worked with 700Credit’s lawyers on one consolidated notice to the FTC covering affected dealer clients, and the FTC accepted it, so dealers that stayed in that arrangement didn’t have to file their own report for this incident, as Auto Remarketing reported. Stores that opted out had to make that call themselves. Within 30 days.
Good outcome. Rare one, too. Don’t count on it.
Then there’s Motility Software Solutions, a dealership software provider. A ransomware attack on Aug 19, 2025 led to notices going to 766,670 people that fall, covering Social Security and driver’s license numbers among other data (BleepingComputer). Smaller number. Same lesson. The data a dealer hands a software company to make the store run smoother is still the dealer’s customer data, and the Safeguards Rule expects you to have picked that vendor carefully, written your expectations into the contract, and kept checking on them after the ink dried.
The third isn’t a breach at all. It’s guidance. Useful guidance, too. On June 16, 2025, the FTC published Safeguards Rule FAQs written specifically for auto dealers. The line I’d underline for every office manager is the one about old customers: you keep protecting a customer’s information for as long as you hold it, even after they’ve stopped doing business with you, until you securely dispose of it.
Two of those three are vendor stories. Notice that. It’s the trend worth tracking.
How the Rule Got Here
When somebody at a twenty group meeting says “the new Safeguards Rule,” it’s worth asking which new one they mean, because there have been a few.
| Date | Milestone |
|---|---|
| May 23, 2003 | Original Safeguards Rule takes effect under the Gramm-Leach-Bliley Act |
| Oct 27, 2021 | FTC announces the amended rule: Qualified Individual, written risk assessment, multifactor authentication, encryption, testing, and board reporting |
| June 9, 2023 | The bulk of the 2021 requirements become enforceable after a six-month extension |
| May 13, 2024 | Breach reporting takes effect: 500 or more consumers, report to the FTC within 30 days of discovery |
| June 19, 2024 | The CDK Global cyber incident takes DMS access away from thousands of stores; public dealer groups disclose it in SEC filings |
I left CDK in there on purpose. It wasn’t a rule change, but it was the week a lot of principals I know stopped thinking of security as a compliance binder and started asking what seven days without the DMS would do to their deal count. AutoNation put a number on it in a July 2024 filing with the SEC: about $1.50 a share off its second quarter, split roughly evenly between lost income and one-time costs, mostly guaranteed pay so commission people didn’t walk out the door while nobody could desk a deal.
Time is money in this business, and that summer everybody got the invoice.
What the News Means for the People on the Floor
I’ll be honest, a list of dates doesn’t help anybody unless somebody walks out of the Monday meeting with a task. Here’s roughly how I’d split this year’s news up if I were sitting at your table.
| Who | The news that lands on them | This month’s task |
|---|---|---|
| F&I | 700Credit, Motility | List every vendor that touches a credit application, with a named contact and the data each portal pulls |
| BDC and main line | CarGurus | Run a practice call where someone asks for a sign-in code, then run another next month |
| Accounting | FTC reporting count, Oklahoma’s law | Put the FTC’s 30 days and each state’s deadline in the incident plan, with a name next to each |
| Service advisors | The June 2025 FTC FAQs | Treat licenses, insurance cards, and payment details at the counter, and the printer behind it, as customer information |
| Every department | All of it | Retire shared logins |
The practice call is the one people skip, so let me tell you why I push it. At the Cleveland Auto Show’s last year at the I-X Center, a couple of brands kept their vehicles locked, display only, and I remember thinking what a missed chance that was, because people come to those shows to sit in the seat and grab the wheel. Training works the same way. What makes somebody hang up on a smooth-talking caller is hands-on experience and repetition, not a policy they signed in March.
And yes, I’m going to bring up the shared logins, because I always do. Workarounds need to be left in the past, and that one F&I or service login everybody knows the password to is the oldest workaround in the building.
None of that is new law. It’s the rule you already have, applied to this year’s headlines.
What We’ll Add Here, and What We Won’t
Each month we’ll log FTC actions and guidance that touch the Safeguards Rule, incidents at vendors dealers depend on, breach filings from publicly traded dealer groups, and state breach-law changes that add a deadline. We support 2,000-plus dealerships, so we tend to hear about vendor incidents early. That’s useful. It isn’t proof. It’s also not a source, so nothing goes on this page until there’s a public filing, notice, or report we can link for you.
We won’t guess who’s next. We won’t name a dealership that got hit. Ever. And this page isn’t legal advice, so pair it with your attorney when a specific incident is on the table.
For the full list of what the rule requires, our FTC Safeguards Rule checklist is the practical version, and the breach notification guide walks through the 30-day report field by field. How we run it all as an ongoing program is on our dealership compliance page.
What Dealers Ask Us About Safeguards News
So did anything in the rule itself change in 2026?
Our credit vendor got breached. Are we the ones filing with the FTC?
Were those 97 FTC warning letters about the Safeguards Rule?
Where does a breach report actually go?
How often is this page updated?
Read the News, Then Check Your Own List
Every entry on this page started somewhere else, at a vendor, a marketplace, or an agency. Not in your store. The stores that came through those weeks calmly were the ones that already knew which vendors held their customers’ data and who in the building owned the call. That’s not a technology win. It’s a people one. The software was the same for everybody that week, and the difference was whether someone had already done the boring work of writing down who held what.
If you’d like a second set of eyes on that list, our complimentary IT and cybersecurity assessment starts with exactly that question.
Know your vendors before the letter comes.