Industry Impact: How remote online notarization is changing the real estate game in the Golden State

Updated June 1, 2026

Dealerships sit on a goldmine of sensitive data, and attackers know it. Social security numbers, credit applications, bank details, and driver's licenses flow through every transaction. That makes every auto dealership a high-value target.

The risk is real and well-documented. In June 2024, a cyberattack on a major automotive technology provider impacted more than 15,000 dealerships, shutting down operations for days and exposing just how fragile the industry's digital infrastructure can be. The fallout was immediate: lost revenue, stalled deals, and damaged customer trust.

Customers notice, and they don't come back. Studies consistently show that consumers who experience a data breach at a dealership are unlikely to return. Lost trust doesn't show up on a balance sheet. Lost revenue does.

Key takeaways

• Culture over compliance: Move beyond annual check-the-box training by making cybersecurity a weekly leadership priority, not solely an IT department responsibility.
• Test your backups: Having data backups isn't enough. Regular restoration testing is critical for ransomware recovery.
• Eliminate password reuse: Use password managers, paired with multi-factor authentication, to secure the sprawl of credentials across dealership systems.
• Phishing awareness: Train staff to identify Business Email Compromise (BEC) and spoofed vendor communications before they click.
• Patch management: Implement a formal schedule to update software and personal devices used for work, and revise security policies whenever new tools are adopted.

If you're treating cybersecurity as an IT problem, you're already behind. When every person on your team feels accountable, suspicious activity gets reported before it becomes a breach. That shift starts with how you frame it from the top.

A tailored cybersecurity plan is how you protect operations and maintain customer trust. Here are five cybersecurity best practices every dealership should implement.

Create a culture of cybersecurity

Annual check-the-box training doesn't cut it. Lessons fade within weeks, and employees go right back to old habits.

Start at the top. Dealership leaders need to make cybersecurity a named priority and communicate that clearly and regularly to their teams. When leadership treats it as a core value rather than an IT problem, the entire organization shifts.

From there, embed security into the rhythm of the dealership:

• Include a two-minute cybersecurity tip at every weekly team meeting. Keep it concrete: one real-world example per week lands better than an annual slide deck.
• Share what a single incident actually costs. Downtime, lost deals, customer attrition, legal exposure: make it tangible so every department understands the stakes.
• Run simulated phishing campaigns and reward employees who flag suspicious messages before clicking.
• Post clear escalation steps so anyone who spots something suspicious knows exactly who to contact and what not to do.

The goal is to make security awareness automatic, not episodic.

Back up dealership data often

Ransomware continues to be a top threat to auto dealerships. When a dealership has a complete, tested backup of its data, it is in a far better position to recover from an attack without paying a ransom. Backed-up data means the dealership can restore operations quickly and avoid the leverage attackers count on.

Backing up is necessary but not sufficient. Most dealerships have never actually tested their cyberattack incident response plan. That matters because problems in the backup process, whether a missed step or an improperly configured automated backup, only surface when you actually try to restore. If the plan hasn't been tested, you won't know it's broken until you need it most.

Test your backups. Run through your incident response plan before an attack forces you to.

Use a password manager

Dealership employees log into multiple systems and apps throughout the day, often across several devices: laptops, phones, tablets. The result is a sprawl of passwords that becomes nearly impossible to manage securely. Many employees end up reusing the same password across systems, which gives attackers easy access once a single credential is compromised.

A password manager solves this problem. Employees use one strong master password to access all their systems, while the manager generates and stores unique, complex passwords for each site. This removes the convenience argument for password reuse and makes it significantly harder for attackers to move laterally through your systems after a breach.

Strong passwords alone aren't enough. Pair them with multi-factor authentication (MFA) on every system that supports it, especially your DMS, CRM, and email. MFA adds a second verification step, like a push notification or one-time code, so a stolen password by itself can't unlock an account. CISA lists MFA as one of the most impactful steps any organization can take to improve its security posture. For a dealership with dozens of employees logging into shared platforms, it's a foundational control.

Educate employees on phishing schemes

With the high volume of emails involved in dealership work, phishing is one of the most reliable attack vectors against automotive businesses. Leaked credentials are widely available to attackers, and automotive businesses represent a consistently high-value target. Cybercriminals use credential dumps as the starting point for phishing campaigns, targeting employees whose login details have already surfaced on the dark web. Your exposure may be larger than you realize.

Beyond standard phishing, Business Email Compromise (BEC) is a growing threat. In BEC attacks, a criminal impersonates a vendor, executive, or supplier to redirect payments or extract sensitive information. These attacks often look completely legitimate and don't rely on malware, which means traditional security tools won't catch them.

Common tactics to watch for:

• Messages from companies or vendors the dealership doesn't work with
• Email addresses that don't match the sender's claimed organization domain
• Urgent requests to download files, click links, or redirect payments
• Emails impersonating a manager, vendor, or lender with slightly altered display names

What you can do:

• Share real examples of phishing emails with your team on a regular basis
• Create a clear checklist for employees who suspect a phishing email, including who to contact internally
• Make one rule non-negotiable: do not click any links, open attachments, or reply to the message until it has been verified
• Run simulated phishing campaigns and recognize employees who flag suspicious messages

Update software and devices

Software updates exist for a reason: they patch the vulnerabilities attackers exploit. Cybercriminals actively target organizations that delay applying those fixes, and unpatched systems are routinely exposed to known, patchable vulnerabilities. The risk compounds quickly as attackers share exploit kits across networks.

The same risk applies to personal devices employees use for work. Phones and tablets that haven't been updated create additional entry points that your IT team may not even have visibility into.

Create a formal patch management program with a documented process and checklist for your IT department. As your dealership adopts new platforms, integrations, or devices, update your security policies to match and make sure employees are trained on every change. Send reminder communications when major software updates are released and make it clear that applying those updates to personal devices is expected, not optional.

The cost of a breach goes well beyond the recovery bill. It's the deals that stall, the customers who don't come back, and the days of downtime your team can't afford.

That's where Proof fits in. With identity verification and document security tools built for auto workflows, Proof adds a layer of protection at every transaction touchpoint, from credit applications to title transfers. Identity is verified before documents are signed, fraud signals are monitored in real time, and every completed transaction produces a cryptographic record that can't be forged or disputed.

Learn how Proof secures auto dealership transactions.