Auto dealerships have spent the past two years learning an uncomfortable lesson about where cyberattacks actually begin. New tracking data from Proton Dealership IT and Cybersecurity, covering July 2025 through June 2026, shows malicious activity against dealers remaining elevated all year, with a surge in March that reached nearly one thousand percent above the level recorded before the industry's major 2024 incidents. That spike was traced to remote-connectivity software that threat actors co-opted to reach business networks. By summer, phishing had overtaken exploited vulnerabilities as the largest attack vector, now accounting for more than half of the activity the firm observes. Industry estimates cited in the same report put the average cost of recovering from a ransomware attack at 1.7 million dollars in 2026, up from 1.5 million the year before.
What stands out in this year's reporting is how little of it starts inside the store. In October, a dealer management platform in Germany was found to have been accessed by an intruder for three full weeks before the provider noticed. The material copied from that system included order numbers, delivery dates, purchase prices, and financing amounts, the details a criminal needs to sound like a store's own finance office. German police and dealers are now bracing for payment-redirect scams in which customers are told, in an email that gets everything else right, that the dealership's bank details have changed. That same month, a flaw in a widely used remote-access VPN appliance was added to the federal Known Exploited Vulnerabilities catalog on the day it was disclosed, and Microsoft shipped its largest security patch release on record. None of those doors were built by the dealerships hurt by them.
Where Dealership Networks Are Genuinely Exposed
When dealership networks are reviewed by our teams, the findings rarely involve exotic threats. They involve doors opened for convenience and never inventoried. Remote-support tools are installed by a DMS vendor here, a phone provider there, and a prior IT company nobody remembers hiring, each running with broad permissions and rarely with a second sign-in factor required. The appliance that lets a controller work from home sits on the internet by design and is the first thing attackers look for. In my experience sitting down with dealer principals, the number of remote-access tools found on store computers is almost always higher than the number anyone in the room could name, and that gap is the real vulnerability. It is also why we wrote about how remote access tools quietly become backdoors, because the pattern is hardly unique to automotive retail.
What Should Be Checked Before the End of the Year
A short list of questions, put in writing and answered in writing, will do more for a store than most purchases. Every remote-support tool on dealership computers should be counted, assigned an owner, protected with multifactor sign-in, and removed if no one can claim it. Each vendor that touches deal data should be asked directly how many days a breach would take to be disclosed, because nine days was recently the gap between a provider discovering an intrusion and one dealer group being told. A line should be printed on every buyer's order stating that payment details are never changed by email or text, which defeats the payment-redirect scam outright. Patching should be verified machine by machine, including the parts counter computer that is never rebooted, and any aging on-premises mail server should be scheduled for retirement. Dealers subject to the FTC Safeguards Rule should remember that these checks are not optional hygiene; they are the substance of what regulators expect to find already in place.
None of this requires a dealership to become a security company. It requires the store to know who holds keys to its systems and to make sure each key is checked, work that can be started this month and finished before the calendar turns. The foundations of dealership cybersecurity were covered in an earlier article, and the trends of the past year have only sharpened the case made there. For our part, the dealers supported by ComSolutions are watched around the clock, and that vigilance has been earned one quiet side door at a time.
