Presented by:
Hey everyone,
Today’s topic is one we’ll definitely come back to again, for better or worse.
If you have a tactic worth highlighting for handling cyberattacks and data breaches, send us a note.
— CDG
First time reading a CDG Newsletter?
Welcome to the Market Pulse—your cheatsheet to auto retail, built to help dealers price right, stock smart, and stay ahead.
29%: North America’s share of cyberattacks in 2025, the most of any region
21%: Share of North American attacks that targeted manufacturing
17%: Share of North American attacks that targeted finance and insurance
56%: Share of vulnerabilities that needed no login to access
(Source: IBM X-Force Threat Intelligence Index 2026, not auto-specific)
North America is taking the most cyberattack hits, all while AI is broadening hackers’ reach.
In February, IBM reported that North America was the victim of nearly one-third (29%) of global cyberattack/breach incidents in 2025, making it the “most attacked region for the first time in 6 years.”
Here’s where the hits landed in North America:
Manufacturing: 21%, the most targeted sector (not auto-specific)
Wholesale: 19% (also not auto-specific)
Finance and insurance: 17%
Globally, manufacturing took 27.7% of incidents, followed by finance and insurance at 27%.
Share of incidents by industry in 2025 and 2024. Source: IBM X-Force.
The same IBM report described AI as “a force multiplier” for cyberattacks.
Their reasoning: Hackers are already using agentic AI to “scale phishing operations, accelerate malicious code development, and enhance social engineering through improved language quality and realism.”
Companies are using it on defense, too, to spot suspicious activity. But per the report, “What AI has changed is the speed, scale, and efficiency of these attacks, which serve to make rapid detection and decisive response more important than ever.”
Take a look at this, which shows vulnerabilities climbing since 2020, with a sharp jump in 2025.
The growth of vulnerabilities since 2020. Source: IBM X-Force.
Behind the chart: A vulnerability is a hole in software that a hacker can slip through, and the more systems a business runs, the more holes it has to patch. What’s scarier is IBM says 56% of the ones it tracks required no login to exploit.
“This trend marks the growing complexity of software ecosystems and available attack surface to include AI systems,” explained the report, adding, “It’s also plausible this increase in vulnerability reporting could result in part from both researchers and attackers using AI and machine‑learning tools to identify vulnerabilities.”
NOTE TO DEALERS:
Dealerships run on connected systems, from the DMS and CRM to OEM portals, and we’ve already seen how frustrating an incident at just one vendor or manufacturer can become.
My advice: Ask your OEMs/vendors how they’d detect and respond to a breach, and what backup resources they have if the main hub goes down. After that, establish a backup-of-a-backup for if those resources aren’t available either.
A quick word from our partner
Every dealer feels it: leads are coming in, but closing them is getting harder.
Podium's AI fixes that. Its agent, Jerry, works every lead until the appointment is booked, sending walkaround videos of the actual car and re-engaging shoppers when a price drops or a new incentive hits.
1 in 4 dealerships use Podium, converting leads 40% above industry average.
Buying more leads won't fix a follow-up problem. Agentic workflows can.
After the Cox VinSolutions cyber incident and the Honda iN outage, we heard from dealers on Daily Dealer Live and in our own reporting about what they did and how they see the situation.
Here are their Dos and Don’ts for staying operational when a vendor or OEM system is compromised or down.
Do: Tighten access as soon as a vendor is hit, even if you see no impact.
Jason Wilkins, dealer principal of Joshua Tree Chrysler Dodge Jeep Ram and Victorville Mitsubishi in California, said on an Oct. 28 episode of DDL that he saw no issues on his end after Cox confirmed the VinSolutions incident.
That said, his stores still made proactive changes to limit the data going into the CRM, credit apps in particular, and he laid out how to tighten access:
“Make sure that your access [to] the data is specific for each employee. Make sure your salespeople don’t have manager access [to] the data.”
Jason Wilkins
The rest of his checklist: No shared logins, remove former employees immediately, turn on IP filtering, ban saved browser passwords, and set computers to lock when people step away.
Do: Use deposits to try to keep deals alive when finance is down.
A Honda GSM who spoke with CDG News (anonymously) on Oct. 28 said the iN outage left finance unable to run or submit credit. It was extra hard at their store, which is “a 70% lease store,” so they asked customers for refundable deposits to close deals.
“They understand once our captive lender is up, we’ll give them a call to schedule them back in,” they said.
Do: Call customers with appointments before they show up if there’s been an outage or cyber incident.
Eddie Palomba, parts and service director at McGovern Automotive in the Boston area, said on an Oct. 30 episode of DDL that when Honda’s iN portal went down, his team couldn’t order parts or pull warranty and repair manuals.
Techs also couldn’t connect HDS to read trouble codes.
“We started contacting customers who had appointments for recalls that we knew we weren’t gonna be able to do. So we were basically trying to contact customers as quickly as possible so we didn’t inconvenience them further.”
Eddie Palomba
Don’t: Leave a vendor without confirmation that your data was deleted.
Wilkins said he moved one of his stores from VinSolutions to Space Auto, which went live Aug. 19. Ten to 12 weeks later, he said he hadn’t heard whether his data had been deleted from the old platform.
His ask: Written notice of confirmation, since it would take that data out of play if there’s a breach later.
“It would be nice if we got some notification from Cox, say, ‘Hey, we deleted your data. Your data’s no longer an issue.’ That would relieve you of the safeguards if there were a breach down the road or in the future.”
Don’t: Promise a parts date an outage might make impossible to track.
An operator at a Honda powersports location in the South told CDG News on Oct. 28 that with ordering and receiving down, their store used third-party parts fiches and Lightspeed to handle walk-in customers.
Service was limited to simple maintenance, and anything needing a techline was on hold. However, they said the problem was with parts already promised to customers.
“For example, I have a warranty repair waiting on parts that were ordered before the outage that I assured a customer would be fixed by this Friday... We can’t track parts or have any idea if anything is still shipping right now.”
The cost: They said the outage hurt their reputation because they couldn’t track parts promised to owners by specific days.
The data up top is more of a global, non-auto-specific snapshot on cyberattacks.
But we included it because we know dealers are relying on vendors less and building and sharing resources more.
Point being: If they (Cox, Honda, global OEMs, etc.) can be exposed, a dealership has every reason to believe something built in-house over the weekend can be, too, especially since IBM points to the growing complexity of software, AI systems now included, as part of why vulnerabilities keep climbing.
Not trying to scare you off. Keep building. Just hold your own tools to the standard you’d hold a vendor to by deciding who gets access to what, what the tool needs, and what you’ll do when it goes down.
