Car dealerships have become a high-value target for cybercriminals because a single store can connect customer records, financing data, service systems, employee accounts and numerous outside vendors. Proton Dealership IT and Cybersecurity’s 2026 data shows how quickly that exposure can turn into a wave of attacks: malicious activity across its U.S. and Canadian dealership clients surged to almost 1,000% above its pre-June-2024 baseline in March 2026. Proton linked the spike to attempts involving older, unpatched versions of remote-access software installers used for legitimate support work.
The episode is a reminder that the danger is no longer limited to obviously malicious files. Trusted tools, stolen identities, vendor connections and convincing phishing messages can all become entry points into the same dealership network.
What the Nearly 1,000% Spike Actually Measures
Proton’s chart puts the March 2026 surge at 997.54% above the level it recorded before the major automotive cyberattack of June 2024. That figure needs context. It is not a claim that every dealership suffered ten times as many successful breaches, nor does it measure stolen customer records. Proton tracked malicious activity observed for its own clients from July 2025 through June 2026. Even after activity dropped sharply in February, the company said attacks remained nearly double its pre-2024 baseline.
The distinction between attempted attacks and successful compromises matters. Proton said its monitoring team detected the March campaign quickly and blocked the activity before its protected dealerships were harmed. The spike then receded, but the underlying level stayed elevated: Proton’s chart shows June activity at roughly 394% above the old baseline. The headline number was therefore a one-month extreme inside a broader pattern of sustained pressure, rather than evidence that every attempt became a breach.
Why Remote-Access Tools Are So Attractive to Attackers
Remote-access software exists for legitimate reasons. Dealerships and technology vendors may use it when a provider needs to troubleshoot a workstation, update an application or diagnose a problem without sending a technician to the store. The same capabilities are attractive to criminals because remote tools can provide broad access while looking familiar to employees and security systems. CISA has warned that threat actors increasingly co-opt legitimate remote-access and remote-monitoring software to reach victim systems.
That history matters because a trusted tool can reduce the need for an attacker to build obvious malware from scratch. CISA previously documented campaigns in which phishing led victims to legitimate products such as ScreenConnect and AnyDesk. Those examples are not proof that either product was behind Proton’s March 2026 dealership spike; Proton did not identify the software in its report. They demonstrate the larger problem: an ordinary support utility can become an attacker’s doorway when deployment, credentials or configuration are abused.
A Trusted Digital Signature Made the Threat Harder to Spot
Proton described the March campaign as exploiting a weakness involving a Windows installer that could be copied while keeping its digital signature intact. The company said attackers had abused the technique across multiple industries for nearly a year before a large wave hit automotive retail. In March 2026, its tools detected attempts using unauthorized copies of the remote desktop solution against old, unpatched installer variants. Proton said none of its customers were negatively affected because the activity was stopped.
The retained signature is an important detail. Digital signing helps establish where software came from and whether it was altered, so users and security products often treat signed code as more trustworthy than an unknown executable. That trust is useful, but it is not proof that a particular installation is authorized or safe. The episode reinforces a basic security principle: patch status, deployment source, configuration and observed behaviour all matter, even when the underlying software is legitimate and signed.
Dealership Networks Hold More Than Vehicle Information
A modern dealership is not just a showroom with a few office computers. Sales, financing, inventory, service scheduling, customer relationship management, accounting and employee systems can all be digitally connected. In the United States, the FTC says most automobile dealers that finance or lease vehicles are financial institutions under the Safeguards Rule. Covered customer information can include financing applications containing names, addresses, Social Security numbers and financial-account information.
The FTC requires covered dealers to maintain a written information-security program and lists controls such as access management, encryption, multifactor authentication, logging, monitoring, testing and employee training. Those requirements reflect the reality of dealership operations: one employee account can sit near several sensitive workflows. A stolen credential may therefore be more useful than a single compromised laptop. The attack surface includes people, cloud accounts, endpoint software and the systems linking the front office to lenders, vendors and other partners.
The CDK Outage Showed What a Dealership Cyber Crisis Looks Like
The auto industry already has a vivid example of how a technology outage can spill onto the showroom floor. In June 2024, a cyberattack on CDK Global disrupted systems used by more than 15,000 retail locations across North America. Dealers reverted to paper forms and manual workarounds while services were restored. Public-company filings described interruptions to sales, inventory, accounting, customer relationship management and other back-office processes. Stores could stay open, but routine transactions became slower and more labour-intensive.
The financial effects were measurable at individual dealer groups. Sonic Automotive later estimated that the outage reduced its second-quarter GAAP diluted earnings per share by about $0.64. Asbury Automotive reported that all CDK functions were not fully restored for its affected stores until July 8, with some connected applications returning later. The lesson extends beyond CDK: dealership cyber risk can become an immediate business-continuity problem, not merely an IT or privacy issue.
MFA Is Necessary, but It Is No Longer Enough
One of Proton’s most striking findings concerns multifactor authentication. In the incidents it examined where compromised credentials were used to gain access, Proton said MFA was deployed 97% of the time. That is not a 97% failure rate for MFA across all logins. It describes a subset of compromised-credential incidents observed by Proton. Still, it shows why a login prompt alone cannot be treated as proof that the person behind it is legitimate.
CISA recommends moving toward phishing-resistant authentication, especially FIDO/WebAuthn, because weaker methods can be defeated through social engineering or interception techniques. Google’s threat researchers have documented financially motivated groups using voice phishing and adversary-in-the-middle methods to bypass traditional MFA and compromise cloud accounts. For dealerships, stronger authentication works best alongside unusual-login detection, shorter sensitive sessions, least-privilege access and prompt removal of dormant accounts. MFA remains valuable; it is one layer of identity security rather than the finish line.
AI Is Making Phishing Faster and More Convincing
Proton attributes part of the rise in dealership attack volume to generative AI, especially its ability to produce convincing phishing messages at scale. That changes the economics of social engineering. Attackers can draft cleaner emails, imitate business language, localize messages and produce variations far faster than a person writing every lure manually. Microsoft’s Digital Defense Report similarly says AI has increased the scale and efficiency of phishing and helped criminals create more realistic social-engineering content.
The evidence is more nuanced than saying AI automatically makes every attempt successful. Verizon’s 2026 Data Breach Investigations Report found phishing led among the AI-assisted initial-access techniques it analyzed, yet phishing’s overall share as an initial-access vector had barely moved in its incident dataset. Verizon cautioned that AI may raise a less-skilled attacker’s baseline without necessarily producing a measurable jump in breach success. The practical risk is volume and credibility: more believable attempts can be launched with less effort, creating more chances for one costly mistake.
Third-Party Access Has Become a Core Security Risk
Third-party access deserves special attention because dealerships depend on a long chain of outside systems and service providers. A vendor may need remote support privileges, an integration token or an account with access to software that touches customer or business data. The FTC tells covered dealers to select service providers capable of maintaining appropriate safeguards, require those safeguards contractually and periodically assess the risk those providers present. Vendor security is therefore part of the dealership’s own security program.
The concern is broader than automotive retail. Verizon’s 2026 DBIR reported third-party involvement in 48% of breaches in its global dataset, up 60% from the prior year. That does not mean 48% of dealership breaches originate with vendors, but it shows how heavily organizations depend on external technology relationships. A practical control is to know which vendors can connect, what they can reach, how they authenticate and whether that access is still necessary. Permanent access should not survive simply because nobody remembers who owns it.
Recovery Costs Can Reach Well Beyond the Ransom
The financial cost of a successful ransomware incident can continue long after the attacker is gone. Sophos’s 2026 State of Ransomware research put the average recovery cost at $1.7 million, excluding any ransom payment. The study included 2,158 IT and cybersecurity leaders from organizations with 100 to 5,000 employees across 17 countries. It is not a dealership-specific estimate, but it captures costs that can accumulate through downtime, investigation, rebuilding, data restoration and lost productivity.
Canadian dealerships can also face privacy obligations when personal information is involved. Organizations subject to PIPEDA must report breaches of security safeguards to the Office of the Privacy Commissioner of Canada when there is a real risk of significant harm, notify affected individuals and keep records of all breaches. Recovery therefore has two tracks: restore the systems that keep the business moving, then determine what information was exposed and what notifications or protective steps are required. A technical incident can quickly become a customer-trust and compliance issue.
Dealerships Need Resilience, Not Just Prevention
The most useful response to the March spike is not to ban remote-access software. It is to reduce the number of ways legitimate access can be turned against the dealership. Proton, CISA and the FTC converge on familiar controls: patch exposed software promptly, inventory authorized remote tools, monitor account activity, limit privileges, train employees against phishing and oversee third-party access. Vendor connections should be deliberate, time-bounded where possible and traceable to a real business need.
Preparedness also has to assume prevention will sometimes fail. Proton recommends maintaining an incident-response and recovery plan and practicing it at least annually. Dealership groups can rehearse how sales, service and accounting will operate if a core platform is unavailable, as many stores did during the 2024 CDK outage. Backups matter, but so do tested restoration procedures, clear contact lists and authority to isolate systems quickly. The goal is resilience: detect suspicious activity early, contain it and keep a localized security event from becoming a multi-day shutdown.
