Dealers and Retailers Led VicOne’s Automotive Ransomware Count in Q3

What the vendor observed

VicOne’s report combines threat monitoring, vulnerability information and security research. Of the 400 incidents it cataloged, 184 were associated with the Americas, 95 with Europe and 93 with Asia. It classified 174 incidents as affecting in-vehicle systems and 149 as enterprise IT.

Ransomware remained the most visible dealership-relevant category. Dealers and retailers accounted for 24 of the 97 ransomware incidents in the dataset, narrowly ahead of suppliers at 23. Those counts describe the vendor’s observed sample; they do not establish that every affected organization disclosed an incident publicly or that every named claim has been independently confirmed.

Why it matters

Dealerships combine payment, identity, finance, vehicle and service data with many external systems and remote users. That makes account access, third-party connections and recovery readiness operational issues, not just IT topics. A ransomware event can interrupt contracting, repair orders, parts activity, customer communications and funding even when the initial entry point is outside the DMS.

The report does not predict an individual store’s likelihood of attack, and the quarter-to-quarter decline should not be treated as evidence that dealership risk has fallen. The more useful signal is that retail remained a prominent target within the incidents VicOne could observe.

What dealerships should do now

Require phishing-resistant multi-factor authentication for administrators, remote access and high-risk vendor accounts. Remove unused credentials, limit each integration to the data and actions it needs, and keep an inventory of vendors that can reach customer, payment, service or vehicle systems.

Maintain offline or otherwise isolated backups and test restoration rather than relying on backup completion notices. Define who can shut off a connection, authorize manual operations, notify customers and regulators, preserve evidence and communicate with OEMs and lenders. Tabletop exercises should include unavailable phones, email, DMS and payment systems at the same time.

How to read the figures

VicOne says the report reflects the sources and systems it monitors. Geographic and quarterly comparisons can move when reporting improves or an incident becomes visible later. Counts are useful for identifying patterns, but they are not a complete global incident census or an independent audit of each victim claim.

Dealer leaders should compare the report with their own access logs, vendor inventory, insurance requirements, recovery tests and incident history. A national or global count cannot replace a store-specific risk assessment.

AI-assisted reporting disclosure

This article was researched and generated with AI-assisted systems using the VicOne report listed below. Dealership Tech Report applies automated accuracy and risk checks, but the incident classifications and counts are vendor-reported and reflect VicOne’s monitoring scope. They should not be read as a complete census or independent confirmation of every incident claim.