a dealer’s systems. Because dealers have many, disparate components and don’t tend to use standard protocols, once their systems are exploited, the breach is difficult to fix.” Other cyber threats focus on personally identifiable information (PII) which can be stolen and resold to bad actors. Forty-four percent of data breaches included customer PII, making it the number one type of data stolen.3 Dealerships regularly handle vast amounts of PII, particularly financial information, so it’s no wonder they’re an attractive cybercrime target. In today’s environment, protecting dealership computer systems and their customer data is essential. “As cybercriminals are becoming increasingly adept, more dealers are realizing an attack could be a ‘business-ender.’ Forward-thinking dealers are investing in technologies that protect against these full-scale attacks. Information technology security is now being viewed as a priority, not simply an expense to be controlled,” states Mr. Nachbahr. The cost of cybercrime The likelihood that a business will experience financial damage after a cybercrime attack is rising quickly. The average cost of downtime from a ransomware attack has doubled over the past year to $274,200.4 The average downtime is now 19 days, a three-fold increase from 2019.2 Direct economic losses are compounded by lost revenues from operational disruptions, brand reputation damage, and decreased customer loyalty. A 2021 IBM/ Ponemon Institute survey found that a data breach costs U.S. businesses an average of $180 for each accessed/stolen record containing customer PII.3 For dealerships with thousands of records, the damage can add up quickly, not to mention the impact on customer relationships. A Ping Identity consumer attitude survey reported that 25% of respondents would stop using a business after a data breach.6 The potential for cybercrime to inflict direct losses, reputational damage, and customer loss highlights the importance of making data security and cyberfraud defense a priority. A salesperson responded to a phishing email, opening a malicious file with ransomware and providing cybercriminals access to that computer. The salesperson did not suspect an intrusion. Once behind the firewall, the hackers were able to access the dealership’s entire system and servers. The hackers used the compromised computer to probe the network, looking for vulnerabilities to lock up the dealership’s computer operations. The criminals were able to shut down the dealership’s systems for over a week – asking for payment in bitcoin to relinquish control of the systems. All of the dealership’s servers and emails and one-third of their 300 computers were inoperable. They chose not to pay the ransom, but instead took the next month to rebuild their systems completely. How could this cyberattack have been prevented? • Through employee education on the hazards of downloading unsubstantiated files or clicking on suspicious links • With proper web filters and controls to block hazardous links • By implementing fraud software to quickly find, mitigate, and recover information compromised by fraud and ransomware attacks Limiting primary fraud threats When it comes time to address criminal activity targeting payments, banking transactions, customer data, communications, and computer systems, it is important to analyze both non-cyber and cyberfraud. Equally important is identifying the sources of threats – internal and external – and dealing with each accordingly. Simple protection measures along with insurance for business crime, cybercrime, or data breaches can dampen losses. Measures to limit risks include: Employee education is the top method for lowering the risk of fraud in general, and cyberfraud in particular. A company culture that values overall fraud prevention Continued on page 24 Issue 3, 2022 23 WVADA
RkJQdWJsaXNoZXIy ODQxMjUw