Security specialists tell Autocar Business the automotive sector faces persistent hacks driven by staff churn, dealer finance systems, and unmanaged access. The immediate fix is basic digital housekeeping: remove forgotten accounts, shrink permissions and treat dealerships like financial institutions.
High staff turnover at dealer groups leaves active permissions and old logins that widen the attack surface.
Dealers process large volumes of finance applications and customer data, making them attractive ransomware targets.
Reducing the number of active accounts, permissions and exposed web servers is a practical first step to lower risk.
Cyber security specialists described the automotive sector to Autocar Business as "an industry under attack" where hacks have become "business as usual." Two recurring themes explain why: workforce churn inside dealer groups and the way dealerships now handle financial products and customer data.
Mark Rodbert, CEO at Idax Software, identified staff turnover as a core vulnerability. When employees leave and their permissions or accounts remain active, organisations widen their attack surface and create easier paths for malicious insiders or credential misuse. Rodbert also pointed to the volume of finance applications handled by dealers. That flow of sensitive customer and payment data turns dealer IT systems into high-value targets for ransomware and data theft.
Alistair Wesson, director of Mongoose Cyber Security, summed up the technical consequence: the more forgotten or unused logins and services remain, the bigger the set of things attackers can try. He recommends shrinking that surface by removing unused permissions and web servers.
Principal vulnerabilities highlighted
Concrete housekeeping actions that reduce risk
These are the low-effort, high-impact controls implied by the specialists' comments:
Recent high-profile incidents across the broader retail and automotive landscape have kept cybersecurity in the headlines, and the automotive sector's own profile has risen because of the combination of operational technology and sensitive customer data. The specialists quoted view the problem as systemic: it's not a single weakness but a cluster of routine operational issues that cumulatively invite attackers.
Why simple fixes matter most right now
Expect continued scrutiny of dealer IT practices and more public reporting about incidents that affect manufacturing and retail operations. Organisations that prioritise deprovisioning and least-privilege policies will reduce near-term risk and complicate attackers' ability to weaponise former employees' credentials or high-volume finance workflows.
ISJ hears exclusively from Claud Bilbao, VP, Underwriting & Distribution for Cowbell about incorporating staff training on cybersecurity. While last year’s cyber-attacks affecting Marks & Spencer, Jaguar Land Rover and Harrods may still be front of mind, the behavioural impact of much earlier cyber-incidents – or lack
Auto major Bajaj Auto has disclosed a ransomware attack affecting its systems and those of its technology subsidiary, triggering an immediate cybersecurity response. While the company says the incident has been contained and mitigated, it has not yet clarified whether operations, production, or sensitive data were impa
A new report reveals Russian hackers were behind the 2025 security breach that paralyzed the British automaker for five weeks. ‘They just wanted to see if they could do it,’ said one official.
Experts warn the Jaguar Land Rover breach bears hallmarks of Kremlin-backed hackers, citing novel ransomware, strategic timing and efforts to obscure attribution
Embedding cybersecurity in a political dialogue signals that automotive OEMs now treat digital risk as a core strategic exposure The post Hyundai and Kia create TED’s first cybersecurity group appeared first on Automotive World .
The hack on car giant Jaguar Land Rover last year was one of the most disrupting, damaging, and costly hacks of the last few years.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.