Cyberattacks against car dealerships have run hot for a full year, and the numbers point to a 2026 spike tied to remote-connectivity software.
Dealership networks spent the past 12 months well above their old normal, per Proton Dealership IT and Cybersecurity. Reynolds and Reynolds bought the US dealership security firm in 2022, and it logged hostile activity across its customer base on both sides of the border between July 2025 and June 2026.
February brought the year’s quietest stretch. Even then, the volume was close to twice the level seen before the 2024 attack that shook the automotive industry. March flipped that: activity jumped to almost 1,000 percent above the pre-attack mark. Threat actors had tried to slip into business networks through remote-connectivity software. Proton ran a broad threat hunt and says it blocked the intrusion before customers felt it, though other businesses were caught up and ransomware followed. Volumes started climbing again in June.
Exploited vulnerabilities used to be the leading route in. Phishing has pulled ahead, now accounting for more than half of what Proton tracks. Chief information security officer Sean Patronis said criminals are leaning on AI to write more convincing lures, and that harvested credentials let intruders enter as though they were employees. Spotting a login from an unexpected location is one way to catch it.
