The Urgency of FTC Compliance for Auto Dealerships in the Face of Cyber Threats

The automotive industry is a rapidly evolving landscape. While digitization of operations has brought unprecedented opportunities, it has also exposed a new frontier of threats: cyber-attacks.

Some facts surrounding cybercrime against auto dealers:

• Dealerships experienced an average of 16 days of downtime after a ransomware attack
• Ransom payments on average were $228,125 for auto dealers
• 84% of customers say they would not buy another vehicle from a dealership if a breach compromised their data
• 70% of dealers are not up to date on anti-virus software creating risk of consumer data theft

Dealerships are attractive targets for cyber criminals because:

• They store large amounts of confidential, personal consumer data, such as customer financial information in financing and credit applications. 
• A large percentage of auto dealers are not up to date on cybersecurity and use outdated systems, and are interconnected to many external interfaces, who are also not up to date.
• Frequently dealership employees lack security awareness training and fall victim to phishing attacks that trick the employees to click on malicious links or attachments, downloading malware.

Dealership Ransomware Cases: A Sobering Reality Check

Arnold Clark, a Glasco-based dealership group was hit with ransomware before Christmas of 2022. This case study serves as a stark reminder of the tangible consequences of a cyber-attack, revealing how attackers stole 15GB of customer data to sell on the Dark Web. Employees were forced to resort to pen and paper to record customer transactions after being locked out of their systems. They were also unable to complete handovers of new vehicles as a result.

In an attack against Pendragon, which operates 160 dealerships, attackers claimed to have stolen five percent of the company’s consumer data and demanded  $60 million as a ransom payment. Cyber attackers can sell the vast reservoirs of sensitive data housed by dealerships, including financial and personal information, in the Dark Web, making dealerships lucrative targets. Additionally, the interconnected nature of automotive systems provides multiple entry points for hackers, intensifying the industry’s susceptibility to cyber threats.

This is why the Federal Trade Commission (FTC) has established the Safeguards Rule, to require dealerships to protect consumer data and privacy. FTC compliance is not just advisable but imperative for auto dealerships, non-compliance can result in hefty legal fees. In 2023, the maximum civil penalty for each count of non-compliance increased to $50,120.

Non-compliance carries financial and reputational risks. When consumer data protection standards are not met, severe penalties can be incurred. The FTC can issue injunctions or cease-and-desist orders to stop auto dealerships from engaging in practices that violate consumer protection laws. These orders may require the dealership to cease certain activities or implement specific changes to come into compliance with the law.

By embracing and implementing the FTC regulation, auto dealerships not only fortify their defenses against cyber threats but also uphold the trust and integrity of their operations. Compliance with FTC rule ensures that auto dealerships navigate the road ahead with security and confidence.

The FTC has now amended the Safeguards Rule, requiring not only implementation of cybersecurity controls but also reporting of a cybersecurity incident to the FTC.

FTC compliance does not need to be costly, stressful or complicated. With CyberCatch, you can attain full compliance in 2 weeks or less and stay safe continuously.

CyberCatch’s innovative FTC Compliance Manager solution enables all non-bank financial institutions, including auto dealerships, to cost-effectively comply with FTC.

CyberCatch’s solution comprises of:

• Workflow engine for compliance risk assessment
• All prescribed controls organized by domains
• Compliance tips
• AI-advisor for detailed guidance and to answer any questions
• Policy and procedure templates
• Charts, reports and evidence repository

With CyberCatch, you can quickly complete the compliance assessment accurately and document attainment of compliance and attain cyber safety.

Check out a quick DEMO.

Ready to get started? > Contact Our Team

Learn More > https://cybercatch.com/ftc-compliance-manager/