The very real threat of automotive cybercrime

Imagine waking up one day to find out that your car dealership has fallen victim to a cyberattack and sensitive customer data has been stolen. This nightmare scenario became a reality for two well-known car retailers over the past six months.

On 23^rd December 2022, car retailer Arnold Clark was targeted by a cyberattack, in which cybercriminals stole customer data. Although the company was initially told all data was secure, it soon became clear that customers’ personal information, including bank details, passports, addresses and National Insurance numbers had been stolen and possibly leaked by Play ransomware onto the dark web¹. Further leaks were threatened, unless the company paid a multi-million pound ransom in cryptocurrency².

Just months earlier, motor group Pendragon was also targeted by a cyberattack, refusing to pay a £53m ransom demand³. We understand that Arnold Clark is now rebuilding its computer infrastructure to create a segregated environment that prevents hackers who breach one part of the network from accessing other parts⁴.

These very real and cautionary tales highlight not only the dangers of a cyberattack and the potential devastation it can cause to a business, but also the fallout of an attack - damaging reputation, company finances and the ability to trade. Perhaps more than anything, they underline the need to have appropriate security and controls in place before a cyberattack happens, not as a reactive measure after an attack has occurred.

Cybersecurity

Cybersecurity measures vary, depending on the size and nature of your dealership or automotive business. With the general rule ‘you’re only as strong as your weakest link’ a good place to start, it reinforces the need for staff training, particularly with so many workers now operating remotely, ensuring employees understand how phishing attacks work and the need to be vigilant at all times. Other security measures include the use of firewalls, endpoint protection and multi-factor authentication that can include the use of biometrics such as face or fingerprint scans, as well as updating programmes and systems in recommended timeframes.

Mitigating risk

As well as ensuring your IT infrastructure security protections are to a good level, you should also ensure your automotive business is protected by transferring risk through an appropriate cyber insurance solution.

This is where PIB Insurance Brokers come into the picture. At PIB, we have the resources and expertise to assess the level of existing and emerging risks your dealership or business faces and ensure you have an insurance solution in place that provides adequate protection.

A good cyber insurance policy will provide you with access to specialist assistance in the event of a cyberattack, including:

• Advice in relation to the payment or non-payment of any ransomware demand
• Statutory obligations in notifying customers of a data breach
• Public relations advice
• IT forensic investigation costs
• The costs associated with responding to regulatory bodies

The insurance coverage itself will also provide for the rectification of your computer systems, any resultant Business Interruption and the defence of any claims brought by third parties resulting from the attack, subject to policy terms, conditions and excess.

Connect with PIB

In the event of a critical cyber incident, PIB will ensure your dealership or automotive business benefits from specialist, proactive assistance, giving you the peace of mind you are in safe, professional hands.

Whatever the size of your business, from small bodyshop repair up to large car dealership, talk to us about specialist risk management and tailored cyber insurance. Call us today on 0330 058 9863 or email: hello@pib-insurance.com

 

Sources:

¹https://www.computerweekly.com/news/365530199/Arnold-Clark-customer-data-was-stolen-in-Play-ransomware-attack
²https://www.dailymail.co.uk/news/article-11662535/Drivers-warned-identity-theft-car-dealers-giant-Arnold-Clark-hit-cyber-attack.html
³https://www.am-online.com/news/dealer-news/2022/10/24/pendragon-defiant-after-hacking-attack-and-53m-ransom-demand
⁴https://www.bbc.co.uk/news/uk-scotland-scotland-business-64488013