Automotive Risk Management Partners ARMP

Dealership Cyberattacks Are Surging and What a Breach Costs You

Terry Dortch President, Automotive Risk Management Partners

Key takeaways

  • Hacks on automobile dealerships increased 155% over roughly the last 18 months.
  • Dealerships that assume they have not been hacked often have simply not discovered it yet.
  • A dealership hack can cost thousands of dollars in recovery and cause significant business downtime, including reverting to manual deal construction.
  • Modern dealership operations depend entirely on electronic systems, making disruption from a hack especially costly.
  • Cyber security involves more than just a penetration test and a vulnerability scan for FTC compliance; dealers need to understand what they are actually protecting.

Summary

Cyberattacks on auto dealerships have reportedly risen 155% over roughly the past eighteen months, a trend many dealers assume does not apply to them simply because they have not personally experienced a breach. The video points to a real-world case, a dealer group called Finley, that was hacked and ended up spending thousands of dollars dealing with the aftermath, including tightening network security and covering the cost of business disruption. Because dealerships now run almost entirely on electronic systems, from digital deals to contracts, a hack does not just cost money, it can force staff back to manual processes and stall operations for days.

For a dealership principal or GM, the message is that cyber security cannot be treated as a compliance checkbox satisfied by an annual penetration test and vulnerability scan for the FTC Safeguards Rule. Terry Dortch argues dealers need to understand their actual exposure and protect the business as the significant asset it is, not just pass an audit. Given the scale of dealership hacking activity, stores that haven't been hit yet should treat that as luck rather than proof of safety, and take a closer, more deliberate look at their overall security posture before an incident forces the issue.

Transcript

Introduction to rising dealership hacks

Hi, my name is Terry Dortch. I'm with Automotive Risk Management Partners. I want to talk to you today about cyber security a little bit. I was reading an article, I don't know, probably last week, where it stated that hacks on automobile dealers is up 155%. And you're probably going, "I've never been hacked. Who's been hacked? None of my friends have been hacked, right?" You're going to say that, but it's probably true.

Real-world example: Finley's hack and its costs

Yeah, call Finley, ask them. They were hacked. They were hacked, and they were hacked to the tune that it cost them thousands. It's cost them thousands of dollars, spent a fortune trying to figure out how to tighten and button down their network, how to do the things that they need to do to make sure that it doesn't happen again. Not to mention everything that went along with that hack, as far as their downtime in the business, a lot of the things that they had when they had to go to manually constructing deals.

Dealership reliance on electronic systems today

This isn't the '80s anymore. The people that come into the dealerships today, they function off of electronic stuff. Everything's electronic today. It's not, when's the last time anybody had to physically do a retail installment sales contract, or the last time somebody hand wrote a lease out? There's only a handful of us left that know how to do that. There's a big cost of disruption, a big cost.

155% increase and urgency to act

So when I'm telling you that you really need to pay attention to the fact that it hasn't happened yet, but it could, and may, you need to listen to this: 155% increase in dealerships being hacked over the last, what was, I think it was 18 months. Huge number. You guys really, really need to pay attention to it.

Cyber security beyond checking the FTC box

You really need to take into consideration that there's a lot more to cyber security than a pen test and a vulnerability scan. That's all, you, I get it, you're checking a box off for the FTC. I get that. Take the time to understand what you're really trying to do. Believe it or not, you guys run a huge business, and it needs to be protected. You need to protect your assets. Here, give us a call, we can take care of that for you. Information is here on the screen.

Questions this video answers

How much have hacks on car dealerships increased recently?

According to an article the speaker read, hacks on automobile dealers are up 155% over roughly the last 18 months, which he describes as a huge number that dealers need to pay attention to.

What does a dealership hack actually cost besides money?

Beyond the thousands of dollars spent tightening and securing the network, a hack causes business downtime and forces dealerships into disruptive workarounds, such as manually constructing deals instead of using electronic systems.

Is a penetration test and vulnerability scan enough for cyber security compliance?

No, the speaker says there is a lot more to cyber security than a pen test and vulnerability scan just to check a box for the FTC; dealers need to understand what they are really trying to protect.

Read more on this

Covered in this video

  • Dealership hacking statistics
  • Cyber security beyond pen testing
  • FTC compliance checkbox mentality
  • Business disruption from data breaches