The June 2024 CDK Global ransomware incident took thousands of North American automotive dealerships offline for weeks, halted vehicle sales at franchise dealers unable to process transactions, and demonstrated in one high-profile event how deeply dependent the automotive retail sector is on a number of dealer management system (DMS) vendors. The direct financial impact was material. The permanent shift in industry awareness of dealership cyber posture is arguably more significant.
This is a summary of what LeakTrace consistently observes when assessing automotive dealerships, written for dealership owners, general managers, F&I directors, and the commercial insurance brokers writing dealership cyber and business owner policies.
Automotive dealerships qualify as "financial institutions" under the FTC Safeguards Rule (Gramm-Leach-Bliley Act) because they arrange consumer financing. The Safeguards Rule requires written information security programs, incident response plans, MFA on customer data systems, and specific security controls. Dealerships that have not implemented Safeguards Rule requirements face FTC enforcement exposure independent of any breach incident. Canadian dealerships face PIPEDA obligations plus provincial motor vehicle dealer act requirements.
Where the exposure concentrates
Email authentication is almost never configured properly
DMARC configuration on the dealership's business domain is the exception rather than the rule. The consequence is direct: the dealership's own domain can be spoofed to send fake financing pre-approval emails (harvesting SSN and income data), fake service department invoices, or fake OEM communications to F&I staff.
Dealer management systems are the operational bullseye
DMS platforms (CDK Global, Reynolds and Reynolds, Dealertrack, PBS Systems, Autosoft) run every operational function of a modern dealership. Compromise of the DMS or the DMS vendor cascades to every dealer using the platform. Recent industry experience with widespread DMS-vendor incidents has made this exposure vivid.
F&I paperwork is a high-value target for identity theft
Credit applications, income verification documents, SSN / SIN data, and complete customer financial profiles pass through the F&I office. Physical paperwork, DMS records, and lender-portal integration credentials all carry sensitive data that is directly usable for identity theft or synthetic-identity fraud.
Third-party integration surface is dense
Lender portals, OEM systems, F&I product providers, service management platforms, marketing automation, and CRM systems each add authentication surfaces. Credential exposure in any one cascades across the dealership's operational stack.
What this means, by role
For dealer principals and general managers
The controls that close the majority of common exposures are boring, cheap, and well-documented. The gap is not knowledge. It is nobody's job. Post-CDK, no dealership principal can credibly claim cyber posture is not their problem. An External Cybersecurity Assessment surfaces the picture and gives you the fix for each finding, step by step. Daily re-checks keep it closed.
For commercial insurance brokers writing dealership cyber and BOP
Underwriters are increasingly requiring email authentication posture, Safeguards Rule compliance attestation, and DMS access controls before quoting. Missing controls are enough to trigger premium adjustments or coverage exclusions post-CDK. Brokers who surface these gaps before renewal win the deeper relationship.
For dealership acquisition consolidators
Dealership acquisitions include cyber diligence as standard. Findings become re-pricing arguments or trigger required remediation before close. Sellers who run their own diligence preserve their negotiating position.
The path forward
Automotive dealerships sit at an inflection. FTC Safeguards Rule enforcement is rising, cyber insurance underwriting has tightened materially post-CDK, and OEM franchise-standard cyber requirements are formalizing. Dealerships that address exposure early protect their operational continuity, their insurability, and their franchise standing.
References
Sources cited in this article. Government and regulator sources (Class A) provide statutory context. Standards bodies (Class C) provide methodology anchoring.
- FBI IC3 Internet Crime Report 2025
https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf - NIST Cybersecurity Framework 2.0
https://www.nist.gov/cyberframework - CISA Cybersecurity Advisories
https://www.cisa.gov/news-events/cybersecurity-advisories - Canadian Anti-Fraud Centre Annual Report
https://antifraudcentre-centreantifraude.ca/index-eng.htm - Office of the Privacy Commissioner of Canada (PIPEDA)
https://www.priv.gc.ca/en/ - FTC Safeguards Rule (Gramm-Leach-Bliley Act)
https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know - CDK Global Ransomware Incident Coverage (Reuters)
https://www.reuters.com/technology/cybersecurity/cdk-global-hit-by-cyberattack-2024-06-19/ - National Automobile Dealers Association Cybersecurity Resources
https://www.nada.org/nada/nada-headlines/nada-cybersecurity-resources
LeakTrace research describes what can be read from outside across the firms we assess. No client is named and no engagement is described. Where a percentage appears, it describes the firms in our view, not a national census.
We will add you to the distribution list. To come off it, email [email protected]. Privacy policy.