Dealers, brands must protect customer data

A sizable data breach disclosed this month at Volkswagen Group of America involving a third party is a timely warning for an industry that continues to quickly expand its online sales capabilities.

Automakers, retailers and those that supply them with services must realize that bad actors constantly go after critical data. Any assurances provided to customers are only as strong as your weakest link — or most vulnerable vendor. Data security must become everyone's job in this industry.

In the breach that became public June 11, some 3.3 million consumer files were accessed, primarily involving Audi as well as some Volkswagen customers from 2014 to 2019, according to the two brands' U.S. parent company. Luckily, the vast majority of the stolen data was low-level contact information — a bit more detail than what an old-fashioned phone book could provide — and only a small fraction contained more detailed financial information that might cause trouble for consumers.

The automaker reported that hackers had accessed the data in an electronic file that the vendor — Shift Digital, of Birmingham, Mich. — had left unsecured.

Consumers whose information was pilfered likely never knew that they had a digital relationship with this particular vendor for VW Group of America. They would have reasonably assumed that their electronic interactions were with their local dealer, or perhaps with the brand or the automaker itself.

Similarly, if any consumers suffer a loss because of this breach, it's unlikely that they will direct their ire at the vendor that collected their information and then failed to secure it.

Properly protecting customer information has always been a necessary job at dealerships. As file rooms have given way to server farms, there must be more than a lock on the door to keep information secure — and that requires additional attention to detail.

Dealers must educate themselves to the online threats their businesses now face daily, and prepare their defenses with no less attention than they pay to their cash flow or inventory.

During the Cold War, "trust, but verify" became an operational mantra for how to live with existential threats. It's also a good one for anyone trying to keep customer data safe from cyberattacks.