Your Dealership Just Discovered a Cybersecurity Breach. What Should You Do First?

Maybe an employee's Microsoft 365 account starts sending messages they didn't send.

Maybe the finance department sees suspicious activity involving an account. An employee reports repeated MFA prompts they didn't initiate. Your security software identifies something on a workstation. Or somebody realizes information may have been accessed that should not have been.

At that point, the dealership has two problems.

There is the cybersecurity problem itself.

Then there is the very human tendency for everybody to start doing something at once.

Someone resets a password. Someone turns off a computer. Someone calls the DMS company. Another person emails the whole management team. An employee deletes the suspicious message because they think they're helping.

Everybody has good intentions, but uncoordinated activity can make it harder to determine what actually happened.

If your dealership discovers a possible cybersecurity breach, the first priority is to activate your incident-response process, get the right technical and leadership people involved, contain the suspected compromise without unnecessarily destroying evidence, and determine what systems, accounts, and information may be affected. Do not start wiping computers, deleting evidence, or making dealership-wide changes before someone is coordinating the response.

You may not know during the first few minutes whether you're dealing with a stolen password, malware, ransomware, unauthorized access, data exposure, or something that turns out to be much smaller.

That's okay.

Your first job isn't to know the entire answer.

It's to keep the situation from getting worse while the people responding figure it out.

The First 15 Minutes: Get Control of the Situation

During the first few minutes, establish who is leading the response, preserve what you know, and take appropriate steps to stop additional unauthorized activity.

The first call should generally go to whoever your dealership has designated to handle cybersecurity incidents and the IT or security team responsible for the affected environment.

Tell them exactly what was observed.

Not what somebody thinks happened. What they actually saw.

For example:

An employee received an MFA request they didn't initiate.

Messages appeared in Sent Items that the employee did not send.

Endpoint security generated a specific alert.

Files suddenly became inaccessible.

A vendor reported suspicious access.

An employee entered credentials into a website and then realized the site was fraudulent.

Those details are much more useful than simply saying, "We were hacked."

From there, the technical response depends on the type of incident. A compromised account might require disabling access, revoking active sessions, changing credentials, and reviewing account activity. A compromised workstation may need to be isolated from the network. A malicious email may require checking whether other employees received or interacted with it.

The important part is that those actions are coordinated.

If ransomware or another active compromise is suspected, CISA advises organizations to isolate affected systems in a coordinated way and preserve evidence that may be useful during the investigation. CISA also notes that simply powering systems off can eliminate volatile evidence, although shutting a device down may become necessary if it cannot otherwise be disconnected and an attack is actively spreading.

In plain English: don't start wiping or rebuilding computers just because you want the problem gone.

You may also be wiping out information that could tell you what happened.

Don't Use a Compromised Communication Channel to Coordinate the Response

If email or another communication system may be compromised, move incident-response conversations to a communication method you reasonably believe is safe.

This is one of those details that's easy to overlook.

Suppose the incident involves an employee's Microsoft 365 account. You probably don't want to coordinate the entire response through that same account.

If you believe an attacker may have access to email, use another approved channel for sensitive incident communication until the situation is understood. That might mean phone calls or another communication system your response team determines is appropriate.

CISA specifically recommends considering out-of-band communications during an active ransomware incident because an attacker may be monitoring normal communications.

You don't need to make this complicated.

Just don't assume the system you're investigating is also the best system to use for discussing the investigation.

The First Hour: Figure Out What You Actually Have

Once the immediate situation is contained, the next step is to determine the scope: which accounts, computers, systems, vendors, and information may be involved.

This is where dealership-specific complexity becomes important.

A dealership may depend on Microsoft 365, a dealer management system (DMS), CRM, lender portals, OEM systems, accounting applications, service platforms, shared files, phones, third-party vendors, remote-access tools, and numerous employee accounts.

One compromised password does not automatically mean all of those systems were compromised.

But you also shouldn't assume the incident stopped at the first thing you noticed.

I would want the response team working through questions such as:

Where did the suspicious activity begin?

Which account or device was involved?

What did that account have permission to access?

Was the same password used anywhere else?

Were there successful logins from unusual locations or devices?

Was email forwarded or modified?

Could the affected user reach customer financial information?

Did the compromised device have access to shared files or other dealership systems?

Could a vendor or administrator account be involved?

What logs exist that can help establish a timeline?

This is where good IT documentation becomes very valuable.

During an incident, you don't want to discover that nobody knows which administrator accounts exist, which vendors have remote access, or which systems depend on a particular server or user account.

NIST's current incident-response guidance emphasizes incorporating incident response throughout cybersecurity risk management rather than treating it as a standalone emergency activity. The current standard, NIST SP 800-61 Rev. 3, addresses detection, response, recovery, communications, and continuous improvement as connected parts of the process.

That's a more useful way to look at an incident than simply asking, "Did we remove the malware?"

The real question is:

Do we understand what happened well enough to know the dealership is safe to keep operating?

Preserve the Timeline While People Still Remember It

Document what happened as the response unfolds, including what was discovered, when it was discovered, and what actions were taken.

Incident timelines get surprisingly fuzzy once several people become involved.

Someone remembers receiving the suspicious email at 9:15.

Another person thinks the account was disabled around 10.

A vendor changed something, but nobody remembers whether it happened before or after the suspicious login.

Three days later, everybody is reconstructing events from memory.

Write things down as you go.

That doesn't mean dealership leadership should personally document technical logs. Your technical team may collect security logs, email records, endpoint alerts, firewall information, system images, or other forensic evidence depending on the situation.

Leadership needs the business-level timeline too.

When did the dealership first know there might be a problem?

Who was contacted?

Which systems were restricted?

When did employees lose access?

Which vendors became involved?

When was normal access restored?

Those details matter for the technical investigation, insurance conversations, legal review, communications, and eventually understanding what should change.

Bring in Cyber Insurance and Legal Counsel Early When Appropriate

A significant cybersecurity incident may involve more than the dealership's IT provider, so review your cyber-insurance policy and involve qualified legal counsel when the circumstances warrant it.

This is an area where I would not improvise.

If your dealership has cyber insurance, look at the actual policy and incident-reporting instructions. Depending on the policy, the insurer or broker may have specific procedures, contacts, forensic firms, legal resources, or approval requirements.

You don't want to spend a large amount of money on outside incident-response services and discover afterward that the insurer expected to be contacted first.

Your IT provider can supply technical facts, help contain the incident, coordinate technology vendors, and work with investigators.

But IT should not decide your legal notification obligations.

If customer information may have been exposed, that conversation should include qualified legal or privacy counsel.

This is also why the questions dealerships see during cyber-insurance preparation matter before an incident. An incident-response plan is much more useful when the phone numbers, responsibilities, policy information, and escalation paths are already documented. What Cybersecurity Controls Do Auto Dealerships Need for Cyber Insurance?

Decide What Can Safely Keep Operating

A cyber incident does not automatically mean every dealership system must be shut down, but operations should continue only where the response team believes they can do so safely.

This can be one of the harder business decisions.

Sales still has customers.

Service appointments are still arriving.

Vehicles are waiting to be delivered.

Accounting has work to complete.

The dealership naturally wants to keep moving.

At the same time, reconnecting a compromised system too quickly or allowing employees to continue using affected accounts can make a problem worse.

The answer depends on what happened.

You may be able to isolate one workstation while the rest of the dealership continues operating normally. Another event might require disabling an entire group of accounts. A broader compromise might mean some systems should remain unavailable until the environment is better understood.

This is where the dealership's business-continuity planning and cybersecurity response need to meet.

Your incident team should be able to tell leadership:

What we believe is affected.

What we believe is safe.

What employees should temporarily stop using.

Which manual processes can keep essential work moving.

What needs to happen before normal access is restored.

If you're looking at the broader preparation side, our article on preparing a dealership for unexpected business disruptions covers that continuity planning in more detail. How to Prepare Your Auto Dealership for Unexpected Business Disruptions

During the First Day, Determine Whether Customer Information Was Involved

Once the incident is contained, the dealership needs to determine whether protected customer information may have been accessed or acquired and what notification obligations may apply.

This is where cybersecurity response becomes a legal and regulatory issue.

For dealerships covered by the FTC Safeguards Rule, the Rule requires a written incident-response plan for security events affecting customer information. FTC guidance for automobile dealers also explains that certain breaches must be reported to the FTC.

Under the current Rule, a covered financial institution must notify the FTC as soon as possible and no later than 30 days after discovery of a notification event involving the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. For this purpose, unauthorized access to unencrypted customer information is presumed to involve unauthorized acquisition unless reliable evidence shows otherwise.

That does not mean every suspicious login or malware alert triggers an FTC notification.

The facts matter.

What information was involved?

Was it customer information covered by the Rule?

Was it actually accessed?

Was it acquired?

Was it encrypted?

How many consumers may be affected?

Those are questions the dealership should work through with qualified counsel and the appropriate technical investigators.

Our FTC Safeguards Rule guide for auto dealerships explains the broader information-security requirements and the difference between the technical work Tech Marvel can support and the dealership's legal compliance responsibilities. FTC Safeguards Rule for Auto Dealerships

New Jersey Dealerships May Have Additional Notification Responsibilities

A New Jersey dealership should not assume that satisfying one federal requirement resolves every notification obligation.

New Jersey has its own data-breach notification requirements. The New Jersey State Police explains that businesses subject to the state's breach-notification law may need to report a breach to the Division of State Police before notifying affected New Jersey customers.

Whether those requirements apply to a particular incident depends on the information involved and the circumstances of the breach.

Other states may also become relevant if affected individuals live elsewhere.

Again, this is where I would involve qualified counsel rather than have the IT company make the legal call.

Tech Marvel can help determine what happened technically.

Legal counsel should help determine what the dealership is required to do with that information.

Control the Message Before Rumors Control It

Employees, customers, vendors, and the public should receive accurate information through a coordinated communication process rather than a mixture of speculation and partial facts.

People naturally want answers.

Employees will ask if they should use their computers.

Managers will ask whether customer information was involved.

Someone may want to email the entire dealership immediately.

Another person may want to tell customers everything is fine before anyone actually knows that.

Neither extreme is particularly helpful.

Leadership should establish who is authorized to communicate about the incident and work with counsel, technical responders, insurers, and other appropriate parties before making statements that could later turn out to be inaccurate.

Employees do need clear operational instructions.

Use this system.

Don't use this one.

Call this number if you see something unusual.

Don't delete suspicious messages.

Don't reconnect that computer.

Those instructions are different from trying to explain the full incident before the investigation is complete.

NIST's incident-response guidance specifically treats communications with internal and external stakeholders as part of effective response and recovery.

Recovery Is More Than Turning Everything Back On

Before returning affected systems to normal operation, confirm that the cause has been addressed and that the dealership is not simply restoring the same conditions that allowed the incident to happen.

If a password was stolen, changing the password may be part of the answer.

But how was it stolen?

Was MFA in place?

Were active sessions revoked?

Were email rules changed?

Were other accounts affected?

If malware reached a workstation, where did it come from?

Did it spread?

What else could that device access?

If a vendor account was involved, does that vendor still need the same level of access?

If the incident exposed a gap in monitoring, backups, access controls, employee training, or documentation, that should become part of the recovery plan.

Otherwise you can technically close the incident while leaving the real problem behind.

That's not much of a recovery.

After the Incident, Ask What Should Be Different Next Time

Every meaningful cybersecurity incident should result in a review of what worked, what created confusion, and what should change before the next event.

This doesn't have to turn into a blame session.

Most cybersecurity incidents involve several layers: technology, people, processes, vendors, access, communication, or some combination of them.

The useful questions are practical.

Did employees know whom to call?

Did IT respond quickly?

Could leadership reach the cyber-insurance carrier?

Did anyone know where the incident-response plan was?

Were the right logs available?

Did the dealership know which outside vendors had access?

Could unaffected departments keep operating?

Did leadership receive understandable updates?

Was one person clearly coordinating the response?

If the answer to some of those is no, now you know what to fix.

That's much more useful than putting the incident behind you and hoping there isn't another one.

Your Dealership Should Know What Happens Before Something Happens

The middle of a cybersecurity incident is a terrible time to decide who is responsible for cybersecurity incidents.

The dealership does not need its Controller to become a forensic investigator.

The General Manager should not have to figure out which logs to collect.

The Dealer Principal should not be calling five vendors trying to determine who is responsible.

Leadership needs to know who owns the response, who handles the technology, who contacts the insurer and counsel, who communicates with employees, and who keeps everyone working from the same set of facts.

Tech Marvel combines dealership IT experience with over 30 years of technology expertise to help New Jersey dealerships reduce downtime, strengthen cybersecurity, coordinate technology vendors, and get clear answers from one accountable local partner.

Our role is to help with the technology side of that process: understanding what happened, containing affected technology, coordinating vendors, helping protect systems and accounts, supporting recovery, and giving leadership clear information about where things stand.

If You Are Dealing With an Active Incident Right Now

If you believe your dealership is actively experiencing a cybersecurity incident, contact the people responsible for your cybersecurity and incident response now. If applicable, follow your cyber-insurance incident-reporting instructions and involve qualified legal counsel.

A marketing consultation should not be the first step during an active breach.

Once the immediate situation is under control, or if you are preparing before something happens, this is the process we use to start the conversation:

1. Schedule Your Dealership IT Review

Schedule Your Free 20-Minute Dealership IT Review so we can understand your dealership, the systems your employees depend on, your current IT environment, and how cybersecurity incidents would be handled today.

2. Review Your Systems, Vendors, and Risks

We look at the technology environment, the vendors involved, user access, security protections, backups, documentation, and the areas where ownership or response responsibilities may be unclear.

3. Get One Local IT Partner Who Owns the Outcome

If it makes sense to work together, Tech Marvel becomes the responsive local IT partner helping coordinate the technology your dealership depends on so leadership isn't left chasing vendors and trying to manage the response itself.

Schedule Your Free 20-Minute Dealership IT Review.

Not ready for a conversation yet? Get the Plain-English Guide to the IT Questions Every Dealership Should Ask Before Switching Providers.

Frequently Asked Questions