Dealerships remain attractive targets for cybercriminals. They combine high-value transactions with large volumes of personal, financial and vehicle data. They also depend on dealer management systems, finance portals, CRM platforms, OEM services, payment providers and third-party support. One compromised account or supplier can disrupt sales, servicing and customer communication at the same time.
The threat has also changed. According to Verizon’s 2026 Data Breach Investigations Report, exploiting software vulnerabilities has overtaken stolen credentials as the leading initial route into breaches. Ransomware appears in almost half of breaches, while third-party involvement has risen sharply. Mobile social-engineering tests also produced higher success rates than traditional email phishing. ENISA’s 2026 threat assessment similarly identifies ransomware as the most immediately damaging incident type and warns that connected digital dependencies expand the attack surface.
Cybersecurity can no longer be reduced to telling employees not to click suspicious links. Staff need simple procedures, while the business must provide secure systems, restricted access and a practiced response plan.
1. Protect every screen, device and conversation
Customer information can be exposed without malware. A visitor may see a finance application on an unattended monitor, a sales discussion may be overheard, or a printed deal jacket may be left on a desk.
Use privacy screens where customers pass behind workstations, position monitors away from public areas and lock screens whenever an employee steps away. Keep paper records in closed storage and dispose of them securely. Sensitive conversations should take place where they cannot be overheard. Customer-facing kiosks and guest Wi-Fi must be separated from employee systems.
2. Verify identity without giving away clues
Attackers collect information from social media, data leaks and public records. A caller may already know the customer’s vehicle, address or recent service visit. That knowledge does not prove identity.
Employees should never reveal information to help a caller pass verification. Do not confirm whether someone is a customer, which bank financed a vehicle, when a service appointment is scheduled or which staff member handles an account unless the person has been authenticated and is authorised to receive the information.
Verification should follow a documented workflow. Avoid security questions based on information that can be researched. For sensitive requests, use a previously registered contact method or secure portal authentication. If contact details are being changed, do not verify the request through the new number or address provided.
3. Treat email, text, QR codes, voice and video as untrusted channels
The old advice to “never open an attachment” is too blunt for a business that must exchange contracts, invoices and finance documents. The better rule is: do not trust a request merely because it looks familiar.
Modern phishing arrives through email, SMS, messaging apps, QR codes, search ads and fake sign-in pages. Attackers also use AI to produce polished messages and convincing voice recordings. The FBI warns that AI-generated voices can impersonate trusted contacts, while NIST advises verifying urgent requests through known contact information.
Employees should pause when asked to sign in, scan a QR code, install software, disclose an MFA code, change bank details or make an urgent payment. Open known portals from a bookmark or password manager instead of a message link. Handle attachments only through approved systems. A flawless message, familiar logo or recognisable voice is no longer proof of authenticity.
4. Require independent approval for high-risk actions
Any request involving money, customer records, account recovery, new payment details, data exports or administrator access should require a second check. This is especially important when the request appears to come from an executive, bank, OEM, supplier or IT technician.
The check must be independent. Do not call the number in the suspicious message or reply to it. Use a number stored in the CRM, supplier master data or an internal directory. Large payments and bank-detail changes should require approval from a second authorised employee.
Managers must make it clear that urgency never overrides this process.
5. Strengthen accounts with phishing-resistant authentication
Passwords alone are not enough. Require multifactor authentication for email, remote access, finance systems, cloud storage, payroll, CRM, DMS and administrator accounts. Where available, use phishing-resistant methods such as FIDO security keys or passkeys. CISA recommends these stronger methods because they are designed to resist fake login pages. SMS codes are better than no additional protection, but they should not be the long-term standard for critical access.
Every employee should have an individual account with only the access needed for their role. Disable unused accounts promptly, review permissions regularly and never approve an unexpected MFA prompt. Help-desk staff need strong identity checks before resetting an account or enrolling a device.
6. Control software, devices and vulnerabilities
Staff awareness cannot compensate for unpatched systems. Maintain an inventory of computers, servers, routers, diagnostic equipment and internet-facing services. Apply critical security updates quickly, especially to remote-access tools, firewalls and VPNs.
Do not allow visitors to use employee computers. Block unapproved USB devices and software where practical. Use managed endpoints with encryption, security monitoring and automatic screen locking. Personal devices should not store customer documents unless formally managed.
If an employee is asked to paste a command into PowerShell or a terminal to “fix” a CAPTCHA, install a support tool or solve a browser problem, they should stop and contact IT through a known channel. Such ClickFix-style scams are designed to make the victim install the attacker’s malware personally.
7. Treat suppliers as part of the dealership’s security boundary
A dealership may secure its network and still be exposed through a DMS provider, marketing agency, payroll platform, managed IT company or payment processor. List suppliers that can access systems or customer information. Define security requirements, restrict remote access, require MFA and remove access when no longer needed.
Ask critical providers how they notify customers of incidents and how the dealership can recover its data. Business-continuity plans should also cover an unavailable cloud service.
8. Make reporting immediate and blame-free
Employees are often the first to notice a suspicious login, changed invoice or misdirected document. Give them one simple reporting route and make it available to every shift and location.
If someone clicks a link, enters credentials or sends information, the safest response is immediate reporting. IT may still be able to reset credentials, revoke sessions, isolate a device or stop a payment. Punishing honest mistakes encourages delay.
Run short, role-specific exercises throughout the year. Practice an executive payment scam, a fraudulent customer-data request, a lost device and a ransomware outage. Measure whether staff report the incident and follow the process – not merely whether they clicked.
From awareness to resilience
Training works best when the secure action is also the easiest action. Staff need approved tools, reliable identity checks, strong authentication and clear escalation paths. Leaders must support employees who pause a transaction or report a mistake quickly.
For U.S. dealerships that arrange financing or offer long-term leases, the FTC Safeguards Rule generally requires a written information-security programme, safeguards for customer information, oversight of relevant service providers and an incident-response plan. Certain incidents involving at least 500 consumers’ unencrypted information must be reported to the FTC within 30 days of discovery. Dealerships elsewhere should map the same operating procedures to their local privacy, cybersecurity and breach-notification requirements.
The objective in 2026 is not to make every employee a security expert. It is to ensure that unusual requests are verified, access is limited, systems are maintained and problems are reported before a small mistake becomes a major interruption. That combination of people, process and technology is stronger than vigilance alone.
Editorial sources
- ENISA, Threat Landscape 2026 (22 September 2026)
- Verizon, 2026 Data Breach Investigations Report
- NIST, Phishing – Small Business Cybersecurity Guidance
- CISA, Require Multifactor Authentication
- FBI, Senior U.S. Officials Impersonated in Malicious Messaging Campaign (15 May 2025)
- U.S. Federal Trade Commission, Automobile Dealers and the FTC’s Safeguards Rule: Frequently Asked Questions
Related Links:
