“You Don’t Have to Be Hacked to Be Compromised”

Salt Typhoon, Scattered Spider, Shiny Hunter, and Silent Starling – sounds like code names from a spy novel, right? These are groups that are actively trying to infiltrate your digital systems and steal your data. Groups like these have compromised hospital systems, payroll platforms, cloud vendors, automobile OEMs, and even cybersecurity firms. Your industry is a target! You can read about the more than 700 incidents since 2023 here.

Dealerships often think, “We’re small. We’re not a target. We’ve got antivirus and a firewall—we’re good.” But here’s the reality: your credentials, customer data, and operational access can be exposed without a single line of malicious code ever touching your systems.

How? Through the vendors you trust. Through the platforms you rely on. And increasingly—through your own employees.

Let’s talk about phishing and vishing (voice phishing – a social engineering attack where criminals use phone calls or voice messages to trick victims).

These aren’t just clumsy scam emails anymore. Today’s attackers are sophisticated. They research your dealership, spoof your vendors, and craft emails that look legitimate down to the font and footer. Or they pick up the phone, impersonate your IT provider, and convince a service advisor to “verify credentials” or “reset a password for security.”

It’s social engineering at its finest. And it’ effective!

The information these hacking groups use to build their campaigns is accumulated from the numerous breaches you read about every month. The good news is there are things you can do to make your dealership and staff less vulnerable.

• Know your vendors and validate the information security measures they use to protect the customer information you share with them.
• Monitor your systems and the dark web for unusual activity and exposed credentials.
• Educate your team to recognize phishing and vishing and implement verification procedures for financial and data requests solicited by third parties.

If you ever want to sit down and walk through your vendor map, your exposure points and systemic risk, or just talk through what’s keeping you up at night, reach out to us. No jargon. No judgment. Just straight talk and a plan.

Matt Vatter

Chief Compliance Officer, Accelerate2Compliance