October is Cybersecurity Awareness Month, and for automotive businesses, it is a good moment to ask whether they are ready for the risks already coming down the road.
The automotive industry has spent decades making vehicles safer, faster, and smarter. Unfortunately, cybercriminals have kept pace. Not long ago, automotive cybersecurity mostly meant protecting customer information, preventing fraudulent wire transfers, and keeping ransomware out of corporate networks. Those threats remain, but the stakes have grown. Today, a single incident can halt manufacturing lines, interrupt dealership operations, expose financial or vehicle data, or disrupt an entire supply chain.
The same technologies driving innovation are behind that shift. Connected vehicles, artificial intelligence (AI), cloud platforms, third-party software, and an increasingly interconnected supplier base have all given attackers more ways in. As a result, an attack no longer needs to start with your company to reach it.
This alert covers some of the threats automotive companies should be watching and what they should be doing about them.
1. The Supply Chain: When Someone Else’s Cyberattack Becomes Your Problem
Few industries understand supply chain dependencies better than automotive. A single missing component can halt an assembly line. Increasingly, the same is true of a compromised technology provider. In 2024, for example, a ransomware attack on a widely used dealership management software provider took systems offline for roughly two weeks and disrupted operations at thousands of dealerships across North America, interfering with vehicle sales, financing, and service. The lesson: a company can suffer a serious operational crisis without its own systems ever being touched.
Manufacturers and suppliers face the same exposure: production scheduling systems, logistics providers, inventory platforms, and cloud services can each become a single point of failure. Cybercriminals know that compromising one provider can disrupt many organizations at once.
What automotive companies should be doing: Start by identifying the vendors and technology platforms your business cannot operate without. Evaluate their security practices, contractual obligations, incident notification requirements, and recovery capabilities. Just as importantly, determine what happens if those systems become unavailable for several days or weeks. Can your dealerships continue processing transactions? Can your plants keep running? Do you have alternative processes that have actually been tested?
In our experience, tabletop exercises frequently reveal that a company has never confirmed how quickly a critical vendor is contractually required to restore service, or that its “manual backup process” exists only on paper.
2. Connected Vehicles: When the Product Itself Becomes a Cybersecurity Risk
Today’s vehicles are computers on wheels, constantly communicating with manufacturers, mobile apps, cloud platforms, dealerships, charging infrastructure, and sometimes other vehicles or roadside systems. That connectivity makes modern vehicles more convenient and capable, but it also turns the product itself into an attack surface.
Researchers have repeatedly shown how flaws in vehicle application programming interfaces (APIs), connected services, and authentication systems can potentially expose sensitive information or allow unauthorized control of vehicle functions. The consequences depend on the vulnerability, but the possibilities range from unauthorized access to location and customer information to interference with vehicle features and, in more serious circumstances, potential safety implications.
A vulnerability affecting a customer database is one problem. A vulnerability affecting the operation or safety of a vehicle presents an entirely different set of concerns. The National Highway Traffic Safety Administration (NHTSA) has emphasized cybersecurity across the vehicle lifecycle in its guidance, Cybersecurity Best Practices for the Safety of Modern Vehicles. That guidance is voluntary, but it serves as a benchmark against which regulators, plaintiffs, and business partners may later measure a company’s practices.
For manufacturers and suppliers selling into global markets, the more demanding benchmarks increasingly come from outside the United States, including UNECE Regulations No. 155 and No. 156 (addressing vehicle cybersecurity and software update management systems) and the ISO/SAE 21434 standard for automotive cybersecurity engineering. Even companies not directly subject to these requirements are often pulled into them through OEM and supplier contracts.
National security concerns are now producing binding U.S. requirements as well. The Commerce Department’s connected vehicle rule bars the import and sale of passenger vehicles containing certain connectivity or automated driving software or hardware with a sufficient nexus to China or Russia, beginning with Model Year 2027 for software and Model Year 2030 for hardware. Because manufacturers and importers must certify compliance based on supply chain due diligence, software and component provenance is now a compliance issue for OEMs and suppliers alike.
What automotive companies should be doing: Manufacturers and technology suppliers should build cybersecurity into product development, evaluate third-party components and connected services (including where their software and hardware originate), establish vulnerability disclosure procedures, and maintain processes for addressing vulnerabilities throughout the vehicle’s useful life.
Companies should also consider how they would respond if a vulnerability affected vehicles already on the road. Who investigates? Who determines whether a safety issue exists? Who communicates with regulators, dealers, and customers? These are questions that should be answered before a researcher, regulator, or customer discovers the problem.
3. Artificial Intelligence: Cybercriminals Just Got a New Set of Tools
Artificial intelligence is transforming the automotive industry, from manufacturing automation and predictive maintenance to vehicle design, customer service, financing, and autonomous driving technologies. Criminals are using the same technology to sharpen their attacks.
AI-generated phishing emails are increasingly convincing. Voice-cloning technology can imitate executives or trusted business partners. Deepfake video and audio can make fraudulent instructions appear legitimate. Imagine a dealership controller receiving a phone call that sounds exactly like the general manager, urgently requesting a payment to secure a vehicle shipment. The voice sounds right. The request appears legitimate. And the money is gone.
AI-related cyber threats also extend beyond impersonation. As automotive companies deploy AI internally, they must also manage the risks of employees entering confidential information into unapproved AI tools, compromised AI integrations, and prompt injection attacks (hidden instructions planted in emails, documents, or web pages that can potentially manipulate an AI tool into disclosing information or taking actions its operator never intended). The risk is greatest when AI tools are connected to internal databases, customer information, purchasing systems, or other business applications.
What automotive companies should be doing: Establish clear AI governance policies, identify where AI is being used, and vet AI tools before connecting them to sensitive information or operational systems. Strengthen payment verification procedures and train employees to recognize sophisticated impersonation attempts. And if your organization is deploying AI agents capable of accessing information or taking actions on behalf of employees, those systems deserve at least the same scrutiny as any other privileged user.
4. Manufacturing and Operational Technology: The Threat Isn’t Limited to Your Email Server
For manufacturers and suppliers, cybersecurity increasingly means protecting the systems that keep production moving: industrial control systems, robotics, manufacturing execution systems, connected equipment, and other operational technology (OT). Many of these systems once ran separately from corporate networks. Today, greater connectivity enables remote monitoring and predictive maintenance, but a compromised corporate network can also create pathways for cyberattacks.
The consequences can be substantial: halted production, delayed shipments, damaged equipment, contractual disputes, and potentially employee safety concerns. And unlike a typical office computer, manufacturing equipment cannot always be shut down, patched, or restored without significant operational consequences.
What automotive companies should be doing: Evaluate the separation between corporate IT and manufacturing systems, restrict remote access, monitor critical connections, and ensure incident response plans address operational technology.
Manufacturers should also understand the cybersecurity practices of equipment vendors and maintenance providers with remote access to production systems. Perhaps most importantly, incident response exercises should also involve operations leadership, not just IT personnel. When a cyberattack threatens production, the decisions are no longer purely technical; they are operational, contractual, financial, and potentially safety-related.
5. The Quiet Threat: Stolen Credentials, Unauthorized Access, and Data Theft
Not every cyberattack announces itself with a ransom note. Some of the most damaging incidents involve attackers using legitimate credentials to steal information without disrupting operations.
Infostealer malware, which harvests saved passwords and session cookies from infected devices, has become a major source of stolen credentials later used to break into corporate systems. Those credentials may subsequently be sold or used to access corporate systems, cloud environments, and sensitive information. Attackers can also bypass multifactor authentication through sophisticated phishing techniques, stolen session tokens, or manipulation of account recovery procedures.
For automotive companies, the information at risk can be particularly valuable: customer financial information, financing applications, employee records, supplier pricing, and proprietary engineering data. A company may not realize that information has been stolen until it appears for sale, is used in a fraud scheme, or becomes the subject of an extortion demand.
What automotive companies should be doing: Strengthen identity and access management, implement phishing-resistant multifactor authentication where feasible, monitor unusual account activity, and promptly revoke unnecessary access.
Companies should also evaluate how long sensitive information is retained and who can access it. An organization cannot adequately protect information if it doesn’t know where that information resides or who can access it.
6. Dealerships and Automotive Finance: Cybersecurity Is Also a Compliance Problem
Automotive dealerships and finance companies face an additional challenge: cybersecurity incidents can trigger substantial regulatory obligations and litigation exposure. Many automobile dealers that arrange financing or leasing are subject to the Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission’s (FTC) Safeguards Rule, which require covered institutions to maintain a written information security program designed to protect customer information.
Depending on the institution’s size and applicable provisions, the requirements include written risk assessments, access controls, encryption, multifactor authentication, employee training, service provider oversight, incident response planning, reporting to senior leadership, and potentially regulatory and individual data breach reporting requirements. State breach notification and privacy laws, consumer protection statutes, and contractual obligations may apply on top of these requirements.
A single incident can therefore involve several overlapping legal questions: Was customer information accessed? Is regulatory notification required? Must affected individuals be notified? Are there contractual reporting obligations? What information should be preserved? Could litigation follow?
What automotive companies should be doing: Review existing cybersecurity programs against applicable regulatory requirements, evaluate incident response procedures, and ensure the organization understands its notification obligations before an incident occurs.
For dealerships in particular, Cybersecurity Awareness Month is an excellent opportunity to revisit Safeguards Rule compliance, including the FTC’s June 2025 dealer-focused FAQs addressing service-provider and OEM relationships, and to assess whether written policies reflect how the organization’s systems and employees actually operate. A cybersecurity policy that looks impressive on paper but doesn’t match daily operations is unlikely to provide much protection when regulators or plaintiffs’ attorneys start asking questions.
7. Ransomware and Business Email Compromise: Still Dangerous, Just More Sophisticated
With so many emerging threats, it would be a mistake to overlook the familiar ones. Ransomware and business email compromise (BEC) remain significant risks throughout the automotive industry; they have simply become more targeted and more disruptive. Ransomware groups increasingly steal information before encrypting systems, allowing them to threaten disclosure even when a victim can restore operations from backups, and some skip encryption entirely.
Meanwhile, BEC schemes continue to exploit the industry’s substantial volume of payments involving manufacturers, suppliers, dealerships, lenders, and other business partners. The FBI has attributed billions of dollars in reported losses to BEC schemes, which remain among the costliest categories of cybercrime. These incidents also frequently raise difficult questions about contractual responsibility, insurance coverage, negligence, and which party should bear the loss.
What automotive companies should be doing: Maintain tested, appropriately protected backups; establish independent verification procedures for payment changes; limit privileged access; and ensure incident response plans address both business interruption and data theft.
Most importantly, do not wait until an incident occurs to determine who has authority to make critical decisions, including whether to shut down systems, engage forensic investigators, communicate with customers, notify regulators, or negotiate with attackers. Each of those decisions can involve significant legal and business consequences.
Experienced cybersecurity counsel should be involved early to help coordinate the response, assess legal obligations, manage communications, and address potential litigation and regulatory exposure.
Start Your Assessment Before the Check Engine Light Comes On
Cybersecurity Awareness Month shouldn’t simply mean another employee training email reminding everyone not to click suspicious links. It should be a chance to evaluate whether cybersecurity programs have kept pace with the technologies and business relationships on which the industry increasingly depends.
That doesn’t necessarily require a complete overhaul of existing security programs. In many cases, meaningful improvements begin with a short self-assessment. Use the checklist below as a starting point – if your organization cannot confidently check off any item, that is a gap worth addressing.
Identify your critical dependencies. Understand which vendors, systems, and connected technologies could significantly disrupt operations if compromised or unavailable.
Evaluate emerging risks. Address AI, connected vehicle technologies, cloud services, and operational technology as part of your cybersecurity risk assessment.
Review your regulatory obligations. Confirm that your cybersecurity program addresses applicable federal and state requirements, including the FTC Safeguards Rule where applicable.
Pressure-test your response plan. Conduct a tabletop exercise involving legal, IT, operations, finance, and executive leadership. Consider scenarios involving a compromised supplier, a manufacturing disruption, or a significant data breach.
Prepare for the legal aftermath. Understand your contractual obligations, insurance requirements, notification deadlines, and potential litigation exposure before an incident occurs.
One particularly useful exercise is to ask your leadership team a simple question: “If our most critical technology provider went offline tomorrow, how long could we continue operating?” If the answer is unclear, that’s a vulnerability worth addressing.
Don’t Wait for a Cybersecurity Recall
The automotive industry has always understood the importance of preventive maintenance. Nobody waits for an engine to fail before changing the oil. Cybersecurity deserves the same attention.
At Baker Donelson, our Cybersecurity and Incident Response Team works with automotive companies and businesses across other industries to address these challenges before, during, and after a cyber incident. We assist with cybersecurity risk assessments, regulatory compliance, AI governance, third-party risk management, incident response planning, tabletop exercises, breach investigations, regulatory inquiries, and cybersecurity litigation.
This Cybersecurity Awareness Month, don’t wait for the warning light to appear. If any of the risks in this article sound familiar – or if you simply want a second set of eyes on your program before an incident forces the issue – reach out to the authors, Matt White (AIGP, CIPP/US, CIPP/E, CIPT, CIPM, PCIP) and Madison “MJ” McMahan, or another member of Baker Donelson’s Cybersecurity and Incident Response Team. We are glad to walk through where your organization stands and what a sensible next step looks like, whether you need a program assessment, help with a specific threat, or immediate assistance with an active incident. After all, preventing a cybersecurity crisis is almost always far less expensive than responding to one.
October is National Cybersecurity Awareness Month
Observed annually in October, Cybersecurity Awareness Month is a collaborative effort between the public and private sectors to raise awareness about cybersecurity. It was launched in 2004 by the U.S. Department of Homeland Security (DHS) and the National Cyber Security Alliance (NCSA).
Throughout Cybersecurity Awareness Month, we will provide proactive tips and information in order to mitigate your cyber risks.
——————————————————-
Click Here For The Original Source.
