The State of Dealership Cybersecurity
Key takeaways
Automotive and heavy-truck dealerships are prime targets for cyberattacks because they keep customer, financing and employee data in one place. This February 2020 report from Helion Technologies explains why attackers go after dealers, what a breach can cost and how to prepare.
Many dealers still underestimate how exposed their stores are.
Some still treat cybersecurity as one more expense to control, and that is a costly mistake. Cybersecurity is a core business practice, and it matters more for dealerships each year as attacks become more common.
Cybercrime at a Glance
The figures below come from studies published between 2016 and 2019. Each one names its source and year, and together they describe the threat picture when this report was published in February 2020.
Why Do Cybercriminals Target Dealerships?
Think about the data a dealership collects and stores every day: customer names, addresses, email addresses and phone numbers in the CRM; bank details and Social Security numbers gathered in F&I; and employees’ usernames and passwords.
Daily operations require a dealership to hold private information for thousands, often tens of thousands, of customers and employees. That makes it a data goldmine for criminals, and sometimes a single phishing email is all it takes to get in. Helion’s post on the anatomy of a phishing attack walks through two real incidents at dealerships.
Who Is Behind the Attacks?
Picture a cyberattack and you may imagine a bored teenager breaking into a server for fun. That picture badly underestimates the people dealerships are up against.
Most of today’s attackers work for large multinational crime organizations, and some of those groups are state-sponsored. The work pays well enough to draw smart, technically skilled people from around the world, and the pay grows with experience. Helion’s post on who cybercriminals are looks at the people behind the attacks and what drives them.
Many dealerships are still not doing nearly enough to protect themselves. Rather than investing in stronger security controls and policies, some ignore the problem and hope for the best. As long as cybersecurity is treated only as an expense to control, the business stays exposed.
How Can a Breach Affect a Dealer’s Reputation?
A breach costs time and money, because it takes real resources to respond to an attack and recover from it. It also puts something harder to rebuild at risk: the dealership’s reputation.
Most dealerships sell the same vehicles at similar prices, so reputation is one of the few things that sets one store apart from another. Customers notice when their data is exposed.
of consumers said they would not buy another car from a dealership after their data had been compromised.
News of a breach travels fast. Between online reviews and social media, customers talk to each other more quickly than ever, and a dealer’s reputation can take a lasting hit. Helion’s post on how a data breach could sink a dealership looks at that risk in more detail.
An attack is not a crisis that ends once the systems are restored. Its effect on a dealership’s bottom line can last for years.
How Do Privacy Laws Raise the Stakes?
Time, money and reputation are not the only things a breach puts at stake. Under new consumer data privacy laws, a breach can also bring legal trouble, including fines or lawsuits.
California’s CCPA, New York’s SHIELD Act and Ohio’s Data Protection Act had already passed when this report was published, and a federal consumer privacy law was under discussion.
states, plus Puerto Rico, saw consumer data privacy bills introduced in 2019.
Many of these laws ask for similar things, including baseline security controls. Putting those controls in place now helps a dealership prepare for new and changing rules.
How Should a Dealership Prepare?
Lowering the risk of a breach and protecting a dealership’s reputation both start with sound security practices. A dealership can begin with the basics on its own:
Those steps lower the risk, but they are only a start. Defining and running dealership security well takes people trained and certified in cybersecurity, and in many dealerships IT security falls to someone who is neither.
One breach could sink a dealership, so trusting its systems and data to someone without that expertise is a risk it does not need to take. Putting IT security best practices in place takes a team that knows both data security and the business of selling and servicing cars and trucks.
Many dealerships keep their own IT staff for on-site and hardware work and add Helion for depth, such as advanced cybersecurity monitoring and extra technical resources. The dealership cybersecurity page has more.
Common Questions
What dealership data do cybercriminals want?
Are small dealerships at risk, or only large dealer groups?
How does a data breach hurt a dealership beyond the cost of recovery?
Do state privacy laws apply to car dealerships?
What security basics should every dealership have in place?
Are the statistics in this report still current?
About Helion
Helion Technologies
Helion Technologies has worked exclusively with automotive and heavy-truck dealerships for nearly 30 years. Founded in 1997 and based in Baltimore, Maryland, it supports more than 2,000 dealerships and 35,000 end users with managed IT, cybersecurity, Tekion enablement, DMS transition support and managed AI. Its founder, Erik Nachbahr, is a CISSP.
Complimentary assessment
Is Your Dealership Secure?
Helion’s complimentary IT and cybersecurity assessment gives better insight into your dealership’s cybersecurity posture and information on how to strengthen its defenses. Request one and a Helion representative contacts you to schedule it.
Prefer to talk first? Call (443) 541-1500.