The Importance of Data Security in Automotive Retail: Safeguarding Customer Information

The recent cyberattack on CDK Global, a leading provider of software services to thousands of car dealerships across the U.S., has been a stark reminder of the vulnerabilities in the automotive industry’s digital infrastructure. Nearly three weeks after the attack, many of CDK’s dealer clients were still grappling with system outages, severely impacting their ability to manage sales, inventory, and customer relations. This incident underscores the urgent need for robust cybersecurity measures in the software systems that dealerships rely on to run their businesses.

The Fallout of the CDK Global Attack

The ransomware attack on CDK Global led to widespread disruption, with some 15,000 car dealerships affected. Many were unable to fully access the Dealer Management System (DMS), a critical tool for daily operations, until almost three weeks after the attack began. This outage came during one of the busiest selling seasons, leading to significant financial losses. In his CBS interview, J.D. Power estimated that the attack could reduce June sales by over 7%, translating to approximately 100,000 fewer vehicles sold compared to the same period in 2023. Additionally, the Anderson Economic Group estimated that the financial impact on dealerships reached nearly $944 million in just the first three weeks following the attack.

This extended period of disruption highlights how a single cybersecurity breach can ripple through the automotive retail sector, causing long-term damage to both dealerships and their customers.

Understanding Regulatory Requirements: FTC Rules for Dealerships

The Federal Trade Commission (FTC) has implemented strict regulations aimed at protecting customer information. Automotive dealerships are required to comply with these rules, which came into effect in June 2023, to enhance data security. As a software provider, it is crucial to not only comply with these regulations yourself but also to ensure that your systems help dealerships meet their obligations.

Key FTC requirements include:

• Designate a Qualified Individual: Appoint a dedicated professional to oversee the information security program.
• Develop a Written Risk Assessment: Conduct thorough risk assessments to identify and mitigate potential threats.
• Limit and Monitor Access: Restrict access to sensitive customer information and monitor those with access.
• Encrypt Sensitive Information: Ensure all sensitive data is encrypted both in transit and at rest.
• Train Security Personnel: Regularly train staff on security best practices and emerging threats.
• Develop an Incident Response Plan: Create a comprehensive plan to respond to data breaches and security incidents.
• Assess Security Practices of Service Providers: Periodically evaluate the security measures of third-party service providers.
• Implement Multifactor Authentication: Use multifactor authentication or equivalent methods to secure access to customer information.

Securing Dealership Data: Best Practices for Software Providers

In light of the CDK Global attack, dealerships are increasingly concerned about the security of the software systems they depend on. As a software provider, it’s vital to not only implement robust security measures but also to clearly communicate how your systems protect dealership data.

1. Advanced Encryption Techniques

Encryption is the foundation of data security, ensuring that even if data is intercepted, it remains unreadable without the appropriate decryption keys. Your software should utilize state-of-the-art encryption to protect data both in transit and at rest. This includes encrypting all customer information, transaction data, and any other sensitive details that pass through your systems.

2. Regular Security Audits

Conducting frequent security audits is crucial for identifying and addressing vulnerabilities in your software. These audits should be thorough, covering all aspects of your system, from code security to user access controls. Communicate the results of these audits to your dealership clients, providing them with the assurance that their data is protected by the latest security protocols.

3. Comprehensive Incident Response Plans

No system is entirely immune to attacks, but a strong incident response plan can minimize the impact. Your software should include features that help dealerships quickly identify, contain, and recover from security incidents. Providing templates and guidance on incident response can empower your clients to handle breaches effectively. 

4. Continuous User Training

Phishing schemes are a common form of cyberattack that often succeed due to user error. These attacks trick employees into revealing sensitive information or granting unauthorized access. According to the National Automobile Dealers Association Workforce Study, the annual turnover rate across all dealership positions is 24%. While this rate has decreased in recent years, high turnover remains a challenge. Continuous training and compliance efforts are essential to mitigate the risks associated with phishing and other user-related errors.

5. Transparent Security Practices

Be open and transparent about the security measures you have in place. Provide dealerships with detailed documentation on how their data is protected, including your compliance with FTC regulations, encryption methods, and access controls. This transparency builds trust and reassures clients that their data is secure.

Partnering with Trusted Vendors

We don’t work in isolation; your partnerships are critical to providing comprehensive service. By working with vendors who meet rigorous security standards, you can ensure that every aspect of your service—from software development to data management—is secure. Partnering with software vendors like Oxlo Systems empowers your dealership’s business intelligence with a stable, protected, and encrypted network. For example, during the recent CDK outage, Oxlo demonstrated its reliability by providing its OEMs partners with critical queuing and gating capabilities at both the business process and dealer levels.

Conclusion

The CDK Global cyberattack has highlighted the critical need for strong cybersecurity measures in the automotive industry. As a software provider, it’s your responsibility to ensure that your systems are secure, compliant with regulations, and capable of protecting your dealership clients from similar threats. By implementing best practices, supporting dealerships in meeting regulatory requirements, and clearly communicating your efforts, you can help safeguard their businesses in an increasingly digital world.

About Oxlo

At Oxlo, we empower DMS, OEMs, and dealerships, to navigate the evolving automotive marketplace with cutting-edge integration solutions customized to your needs. Our software harnesses the power of automotive business intelligence, streamlining operations to enhance revenue, customer experience, and enterprise integration, with a reliable, protected, and encrypted network.