For a dealership, a cyberattack can be devastating. In worst-case scenarios, business is shut down, backups are lost, data is stolen and ransom is demanded.
The average cost of a cyberattack to a business globally was $4.45 million in 2023, according to IBM. And for dealerships specifically, one of the biggest costs can be lost business while breaches or attacks are sorted out, Nikhil Kalani, chief information security officer at Reynolds and Reynolds, told Automotive News.
To protect against these events in an era of mounting cyber uncertainty, Reynolds’ cybersecurity company Proton helps dealers adopt a layered defense and a culture of security, Kalani said.
Experts are seeing attacks at “a volume and quality like never before,” he said, adding that “it is far cheaper to pay for protection than to pay for the damage.”
Reynolds and Reynolds acquired Proton last year in the wake of growing cybersecurity needs and compliance requirements. Most notably, the FTC implemented and amended the Safeguards Rule to push dealers to be vigilant in cybersecurity and data protection.
Often, dealers are not targeted individually but instead fall victim to a trap launched at many businesses. In those situations, the “targets select themselves,” Kalani said. Stolen data might allow an attacker to log in to a dealer’s system using an employee’s credentials, he said.
Members of Proton’s cybersecurity team work in a collaborative office at Reynolds’ headquarters in Dayton, Ohio, surrounded by large video screens on three sides displaying the latest cybersecurity news and a global map constantly tracking incoming hacking attacks on businesses across the U.S. A couple of boards show the status of Proton customers who have been the target of attempted cyberattacks.
A combination of 24-hour monitoring and automated protections can shut down an incursion in seconds, Kalani said. Meanwhile, more serious issues require human intervention and might take roughly 30 minutes to solve.
Stopping the attack is only the first step. Proton also emphasizes investigating incursions to help dealers be better protected in the future, Kalani said.
Bryan Honda in Fayetteville, N.C., became a customer of Proton because it combines many cybersecurity offerings under one provider and helps the store maintain FTC training compliance, said Fred Cuddy, the dealership’s operations director and chief information officer.
“A dealership can’t go down. We absolutely rely on computers for every aspect of dealership business,” Cuddy said. “If you let your guard down for one second, you can be a victim and you are basically out of business until it’s fixed.”
Meanwhile, Kalani said a lack of education on cybersecurity continues to suffuse the automotive retail industry, which is especially problematic because no individual defense measure will be perfect. Regular training can help staff catch traps that slip through automated defenses, he said.
It is key that stores develop this “culture of security,” said Jason Aubry, a marketing communications representative at Reynolds. Dealerships need their staff to be “paying attention to what they are clicking on and where it is coming from.”