Cyber Liability Insurance for Auto Dealerships
Federal law makes you a financial institution because of your leasing business, and your whole store runs on one vendor’s platform. Cyber Insurance Group has agents dedicated to cyber liability, comparing dealership coverage across 12+ A-rated carriers.
Compare your dealership across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteA Bank’s Paperwork in a Retailer’s Building
A dealership assembles the kind of financial file a lender would hold, then runs the entire store on a single platform.
The deal jacket
Credit applications, Social Security numbers, driver’s licenses, pay stubs and bank details, captured per customer and retained for years.
One system runs everything
Sales, service, parts, CRM and accounting typically sit in one dealer management system, so an outage there is not a department problem.
Service keeps the data too
Customers who never financed anything still leave contact details, vehicle identifiers and payment cards at the service counter.
Volume with thin IT
A single rooftop can hold tens of thousands of customer records while employing nobody whose job is security.
You Are a Financial Institution, and You Are a Single Point of Failure
The first is narrower than people say. The second is wider.
What the rule actually says
The Safeguards Rule’s own example is specific: an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days, is a financial institution with respect to its leasing business. Source: 16 CFR 314.2. Arranging credit works on the same logic.
Why the narrow scope does not help you
The obligation is scoped to an activity. Your systems are not. A credit application captured in the finance office lands in the same platform the service advisor and the parts counter use, and an attacker who reaches that platform does not care which department the regulation was aimed at.
And the vendor question, documented
In a public filing dated June 24, 2024, Asbury Automotive Group stated it learned on June 19 that its vendor CDK Global had experienced a cyber-attack impacting services including sales, service, inventory, customer relationship management, and accounting. The same filing noted that its Koons locations, which did not use CDK’s dealer management system, continued to operate with minimal interruption. Source: SEC filing.
That contrast is the whole argument
Two groups of stores, one incident, completely different outcomes, decided entirely by which platform they ran. No marketing material makes the case for dependent business interruption cover as plainly as that filing does.
Where the card actually gets compromised
- Online stores: the exposure happens in the customer’s browser, through scripts on your payment page.
- Auto dealerships: the exposure happens in the finance office, where you become a financial institution and your whole operation runs on one vendor’s platform.
- Convenience stores and fuel: the exposure happens at a terminal standing outside, unattended, that a person can physically open.
Why it changes the policy conversation
Ask about dependent business interruption before anything else: whether it is included, what triggers it, and how the waiting period is measured against a store that cannot write a deal. Our data breach response guide walks through the sequence.
Built for the Day the Platform Goes Down
Your vendor’s incident
Dependent business interruption responds when the dealer management system, not your store, is the point of failure.
Customer notification
Breach response funds notifying customers whose credit applications and identity documents were exposed.
Regulatory response
Regulatory defense coverage answers the inquiry that follows an incident involving covered financial information.
Deals you could not write
Business interruption responds to revenue lost while sales and service cannot transact.
Before You Decide
The objections we actually hear from business owners, answered straight.
Is a car dealership really a financial institution?
For part of what you do, yes, and the rule says so directly. The FTC’s Safeguards Rule gives as an example an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days, and states it is a financial institution with respect to its leasing business. Arranging financing works the same way. The status attaches to the F and I side of the store rather than to the service lane.
If only F&I is covered, why does it affect the whole store?
Because the data does not stay in the finance office. Credit applications, Social Security numbers, driver’s licenses, income documentation and bank details are captured in the deal jacket and then live in the same dealer management system your sales, service and parts departments use every day. The obligation is scoped to an activity; the systems holding the information are not.
What did the CDK incident actually show?
How much of a dealership runs on one vendor. In its public filing, Asbury Automotive Group said it learned on June 19, 2024 that CDK Global had experienced a cyber-attack affecting services including sales, service, inventory, customer relationship management and accounting. The same filing noted that its Koons locations, which did not use CDK’s dealer management system, continued to operate with minimal interruption. That contrast is the clearest argument for dependent business interruption cover you will find anywhere.
Does our cyber policy cover an outage at our DMS provider?
Only if it includes dependent business interruption, and that is the clause to check first. Standard business interruption responds to an incident on your own systems. When the compromise is at the vendor whose platform runs your store, you need cover that reaches outside your walls. Ask how it is triggered and how the waiting period is measured.
Who notifies customers if the breach was at our vendor?
Usually you, because the customer relationship is yours and the Safeguards obligations attach to your business. Your vendor agreement should set out what they tell you and how quickly, but the person whose credit application was exposed is your customer and will expect to hear from the dealership.
What does cyber liability insurance not cover for a dealership?
It does not cover vehicle theft, floorplan losses or physical damage to inventory. It does not answer a sales practices, advertising or lemon law claim. It does not pay the fine for an inadequate information security program. It covers the incident response, the customer notification, the liability claims and the revenue lost while you cannot transact.
What Would Cyber Liability Insurance Cost Your Dealership?
Pricing follows rooftops, how many customer records you hold, which platforms you depend on, and the controls you can evidence. See the breakdown in our cost guide, or get a number for your store.
Compare 12+ A-rated carriers for your dealership
Free, no obligation, about 4 minutes.