Skip to content
Close
SEARCH
Join NHADA
Join NHADA
Dealership_Hero

JOIN OUR COMMUNITY

NHADA Supports the Success of Over 500 Motor Vehicle Businesses
BECOME A MEMBER
UPDATES
Smiling employee's in a line at work

Explore Cost-Effective Insurance & Workers' Comp. Plans

Get a free Quote
REPORT AN INJURY ONLINE (FORM 8-WC)
Association Events
Learn about NHADA's major events and fundraisers.
VIEW ALL EVENTS
UPCOMING EVENTS
INDUSTRY TRAINING
Explore upcoming webinars, seminars, and on-demand training.
VIEW ALL TRAINING
    ON-DEMAND TRAINING

    Off the Clock Video Series

    Explore the fascinating lives of automotive professionals in our new video series, "Off the Clock"

    FREE PARTNER OFFERS
    ALL OFFERS
    Compliance/Industry Guides
    VIEW ALL GUIDES

    Can't find what you're looking for? Try one of NHADA's partners.

    LotDrop-Nav_Supplies

    Forms & Supplies

    Start Shopping

    LotDrop-Nav_Apparel

    Corporate Apparel

    Start Shopping

    LotDrop-Nav_Promo

    Promotional Items

    Start Shopping
    cdk data breach
    ComplyAutoJun 21, 20241 min read

    CDK Incident Sparks Phishing Scams - Reports

    Scammers Taking Advantage of CDK Incident 
    As ComplyAuto previously warned about, CDK customers should be aware of bad actors attempting to take advantage of the CDK incident, including via potential 'bandwagon' phishing attempts. Reports have emerged stating that bad actors are sending communications falsely claiming to be CDK employees who can help get dealerships back online. Dealer employees should be aware of these phishing attempts in order to protect the dealer's accounts and systems from these secondary bandwagon attacks.

    Data Breach Reporting Refresher
    In this video, ComplyAuto's Brad Miller addresses questions received from numerous dealers about their potential obligations if it is determined that customer data has been breached. Note that as of the time of publication on June 20, 2024, there is not currently any evidence that suggests consumer data was compromised as part of the CDK incident.

    Dealer reporting obligations under state and federal law

    PARTNER SPOTLIGHT

    Here is a brief summary of the points Brad discusses

    1. Potential reporting under federal regulations
      -   FTC recently amended the Safeguards Rule to include a requirement to report to the FTC any "notification event" (commonly referred to as a "breach") involving 500 or more customers' unencrypted data as soon as possible, and no later than 30 days after discovery of the event.
      -  Dealer must report the breach even if it happened at a vendor.
      -  FTC reports are public information.
    2. Potential reporting under state law
      -   Definitions, timeframes, and reporting thresholds differ among the states.
      -   State laws often require a dealer to provide customer notification, and a dealer may also have to notify a state agency.
      (Check out the ComplyAuto breach reporting wizard tool for more information.)
    3. Business Interruption Insurance Coverage
      Dealers whose operations are impacted by the CDK systems being down might consider exploring whether they have business interruption coverage under any of their insurance policies that could provide relief for expenses and losses arising from the interruption in business resulting from the outage. Each insurance policy is different and historically business interruption coverage was associated with physical casualties (e.g., fire damage), but in recent years some cyber insurance policies have included business interruption coverage. 
    avatar

    ComplyAuto

    RELATED ARTICLES