Malicious activity aimed at car dealerships rose to nearly 1,000% above pre-summer 2024 levels in March, and multifactor authentication was in place in 97% of the cases where attackers got in with stolen logins, according to research by a dealership IT and security vendor that was promoted in a sponsored article Automotive News published Monday. The figures have not been independently verified, but they bear on duties U.S. regulators already place on many dealers.

What Happened

The sponsored piece, "The State of Dealership Cybersecurity: How New Threats Are Changing the Game," appeared in the partner-content section of Automotive News without a byline and linked to Proton Dealership IT, which sells IT management, round-the-clock monitoring and compliance help to dealers. Proton's home page says more than 750 dealership locations use it. Trade publication Canadian Auto Dealer describes the company as acquired by dealer software maker Reynolds and Reynolds in 2022, and Proton's privacy policy lists a contact address at One Reynolds Way in Dayton, Ohio.

The figures come from Proton's report "The State of Cybersecurity 2026." Its public page states the nearly 1,000% March spike, says artificial intelligence was making attacks easier to run and says the report covers July 2025 to June 2026. The full document requires a name, email address and company to download; The Primary Wire did not submit the form, so it could not review the report's method.

RelatedAttackers Breach Three Country-Code Registries to Obtain Google Certificates

Canadian Auto Dealer reported that the data covers malicious activity across Proton's clients in the U.S. and Canada and that phishing, meaning deceptive emails or messages that trick staff into handing over access, now makes up more than half of the attacks Proton sees. Proton's chief information security officer, Sean Patronis, told trade outlets the March surge involved remote-access software, which Car Dealership Guy described as tools that let third-party vendors troubleshoot dealership systems. Neither outlet named the software. Car Dealership Guy also reported the 97% MFA finding.

How Far the Numbers Go

The data reflects only what one vendor observed among its own customers. A percentage rise from an unpublished baseline says little about how many dealerships were actually breached, and neither the report's public page nor the trade coverage explains how Proton defines or counts an attack. The company also sells the monitoring its report recommends.

The MFA figure needs care too. It describes a subset of cases, those in which stolen credentials worked, not all logins. It does not show MFA is useless; it suggests the forms in use could be defeated. The Cybersecurity and Infrastructure Security Agency, known as CISA, warned in its 2022 fact sheet "Implementing Phishing-Resistant MFA" that attackers can trick people into typing one-time codes on fake login pages or flood them with approval prompts until they accept one.

Why It Matters

The stakes for dealers are documented. On June 19, 2024, CDK Global, which serves more than 15,000 dealers in North America, shut down systems after a cyber incident, BleepingComputer reported, and some dealerships fell back on paper. At least five publicly traded dealer groups told investors about the disruption, Cybersecurity Dive reported. Lithia Motors said in a Form 8-K that the outage hurt its operations and that it cut its connections to CDK.

Federal rules already cover much of what the sponsored piece urges. Under the Federal Trade Commission's Safeguards Rule, dealers that finance or arrange financing, or lease vehicles for more than 90 days, are financial institutions. The agency's June 2025 FAQ for dealers says they need MFA or a reasonably equivalent control for anyone accessing their systems, including service providers with direct network access. Dealers must also oversee vendors, keep a written incident response plan and have a designated security lead report to the board in writing at least annually. Since May 2024, a breach exposing unencrypted data on at least 500 consumers must be reported to the FTC within 30 days of discovery.

For owners and boards, that points to concrete questions: which form of MFA staff and vendors use, which outside firms hold remote access and how it is switched off, whether the response plan has been rehearsed, and whether the team could meet the FTC's 30-day clock.

What to Watch

Whether Proton makes its method and baseline public, or names the remote-access tool tied to the March activity, will determine how much weight its figures can bear. Watch, too, for government advisories or independent research on dealership attacks that could confirm or contradict the vendor's trend.