Automotive dealerships and retailers recorded more ransomware incidents than any other segment of the automotive industry during the third quarter of 2026, according to cybersecurity company VicOne.
Its latest Situational Awareness Report counted 24 incidents involving dealers and retailers between July 1 and September 30, narrowly ahead of suppliers, which recorded 23.
The figures highlight the risks facing businesses that depend on digital systems to sell vehicles, manage customer information, process transactions, and keep service departments operating.
These figures should be interpreted with caution because they represent incidents identified and classified by VicOne, rather than a comprehensive tally of all ransomware attacks targeting automotive businesses worldwide.
The report reflects the company’s monitoring scope and available threat intelligence. Even with that limitation, the findings show how cyberattacks can affect businesses throughout the automotive supply chain, not just vehicle manufacturers.
Why Dealerships Have Become an Important Cybersecurity Target
Modern dealerships rely on interconnected software to manage nearly every part of their operations. Customer relationship management systems track sales leads and communications, dealer management systems handle inventory and transactions, and service platforms coordinate appointments, repair orders, and vehicle inspections.
Finance and insurance departments also process sensitive customer and financial information. A ransomware incident can interfere with these systems simultaneously.
Employees may lose access to digital records, managers may struggle to establish which vehicles are available, and service advisers may be unable to retrieve repair histories or update customers. Even when the physical showroom remains open, the business may be unable to complete transactions at its normal pace.
VicOne’s Q3 report recorded 97 ransomware incidents across the automotive value chain. Dealers and retailers accounted for 24, suppliers for 23, logistics and transportation for 13, and original equipment manufacturers for another 13.
The distribution indicates that the exposure extends beyond vehicle assembly plants into the businesses that sell, distribute, and support vehicles.
The dealer figure is particularly relevant because dealerships often depend on a mix of software from multiple providers. A store might use separate systems for sales, customer communications, service scheduling, parts inventory, and accounting.
Connections between those applications can make workflows more efficient, but they also create additional points that need to be secured and monitored.
Third-party access is another consideration. Software vendors, IT contractors, and other service providers may need authorized access to dealership systems to maintain applications or resolve technical problems.
If an account is compromised or a vendor connection is improperly secured, attackers may be able to use that access to reach additional systems. The risk is not unique to dealerships, but the number of connected business applications makes access management especially important.
Ransomware attacks also vary in their methods and consequences. Some attackers encrypt files or systems and demand payment for a decryption key. Others steal information before disrupting operations, then threaten to publish the data unless the victim pays.
A ransomware attack can disrupt business operations and potentially expose sensitive customer or employee information. However, the occurrence of an attack does not necessarily mean that data was stolen, as this must be confirmed through evidence specific to the incident.
Operational Disruption Can Become a Customer-Service Problem
A dealership does not need to lose its entire network to experience a serious disruption. If its appointment system, repair-order software, or parts inventory platform becomes unavailable, service teams may have to postpone work or rely on manual records.
Sales staff may struggle to locate vehicle histories, complete paperwork, or coordinate financing. Recovery can take time even after the initial intrusion has been contained because affected systems must be checked and restored safely.
The consequences can extend beyond lost sales. A customer arriving for a scheduled repair may face delays if technicians cannot access service histories or advisers cannot create normal repair orders.
Parts deliveries can be harder to coordinate when inventory records are unavailable. If multiple stores within a dealer group share infrastructure, a disruption at one location could also affect other locations, depending on how the network and applications are connected.
Data exposure creates a separate risk. Dealerships may hold names, addresses, contact details, vehicle identification numbers, financing paperwork, and other sensitive customer information.
The exact data stored varies by business, and an incident does not automatically mean all of it was accessed. But if attackers obtain customer records, affected people may face targeted phishing, identity theft, or attempts to exploit information from previous vehicle purchases.
Federal Trade Commission guidance specifically addresses automobile dealers’ obligations under the Safeguards Rule. Covered dealerships must maintain an information security program and prepare an incident-response plan.
If a security event results in the loss of unencrypted customer information, the FTC says a notification event may require notice to the agency within 30 days, subject to the rule’s definitions and requirements. Applicable state breach-notification laws may impose additional obligations.
This regulatory dimension can make a ransomware incident more expensive than the immediate cost of restoring computers. Businesses may need outside cybersecurity specialists, legal advice, system rebuilding, customer communications, and additional safeguards.
The scale of those expenses depends on the incident’s scope, the information involved, and the length of the disruption.
VicOne’s figures should not be interpreted as 24 confirmed breaches of customer data or 24 dealerships that necessarily paid ransoms.
The vendor’s figures reflect the number of ransomware incidents reported in the dealer and retailer sector. However, these counts alone do not reveal how much data was stolen, how long operations were disrupted, or the financial damage caused by each incident. Distinguishing between incident frequency and actual impact is essential when evaluating the severity of the problem.
How Dealerships Can Reduce Their Exposure
The findings give dealerships a reason to treat cybersecurity as an operational priority rather than simply an IT expense. The first step is identifying which systems are essential to sales, service, parts, and customer communications, then determining how the business would continue operating if one or more became unavailable.
A written response plan should assign responsibilities, establish escalation procedures, and explain how staff would communicate with customers during an outage.
The Cybersecurity and Infrastructure Security Agency recommends maintaining offline, encrypted backups of critical information and testing restoration procedures regularly. Backups are useful only if the business can recover from them, and systems should be checked carefully before restored data is reconnected to the network.
CISA also recommends multifactor authentication, prompt security updates, and an incident-response plan that is exercised before an emergency occurs.
Dealerships should pay particular attention to remote access and third-party connections. Access should be limited to the systems and information each employee or supplier needs, while former employees’ accounts and unnecessary permissions should be removed promptly.
Multifactor authentication can make stolen passwords less useful to attackers, particularly for email, remote access tools, and administrator accounts.
Employee training is another practical safeguard. Staff should know how to identify suspicious messages, verify unexpected payment requests, and report unusual computer behavior quickly.
Phishing remains a common route into business networks, and a convincing message can target sales staff, service advisers, or accounting employees just as easily as IT personnel. Training should be reinforced with clear reporting procedures rather than relying on employees to recognize every threat independently.
Dealership groups should also ask technology providers about security controls, incident notification procedures, and recovery arrangements before connecting new systems. Contracts and vendor reviews should make clear who is responsible for protecting information, investigating an incident, and communicating with affected customers.
VicOne’s Q3 2026 report counted 400 automotive cybersecurity incidents across the sectors it monitored, including 97 ransomware incidents. That total was down from 477 incidents in the second quarter, illustrating that the report describes observed activity during a particular period rather than a steadily rising count in every category.
The 24 dealer and retailer ransomware incidents remain a significant finding, but they should be understood within that broader dataset and its monitoring limitations.
For dealers, the practical lesson is that digital resilience is part of keeping the business running. Strong access controls, reliable backups, employee training, and tested recovery plans cannot eliminate every attack, but they can reduce the likelihood that one compromised account becomes a prolonged business crisis.
As dealerships become more dependent on connected sales and service platforms, preparing for disruption is increasingly important to protecting customer information and maintaining day-to-day operations.
