Why now

Four things happened, and dealers started asking their vendors different questions.

June 2024. Ransomware at a dealership software provider closed about 15,000 rooftops for roughly two weeks. The supplier’s outage was the dealer’s outage.

October 2025. A vendor breach exposed more than 5.8 million people’s Social Security numbers. The vendor was breached; the dealer held the relationship with the customer.

Through 2026. 97 FTC warning letters to dealers, and two settlements. Pricing conduct, not data security — but in every one of them the dealer was the named party, not the software company.

August 2026. More than 153 million driver’s license images were offered for sale. That is the document a dealership copies more than any other.

None of this makes a dealership responsible for its vendors’ engineering. It does mean the dealership is the one standing there when something goes wrong.

The full study publishes in October 2026.