Dealerships targeted by ransomware

Jim Arrigo woke up on a Monday morning and tried to log into the email network for his family's dealership group in South Florida.

He was locked out, and he didn't know why.

The call he placed next to his information technology staff would uncover a chain of events that effectively halted business for up to three days at the five-store group, brought in the FBI and has cost Arrigo more than $250,000 — and counting — to rebuild the company's computer network.

The problem? Ransomware, invited in through a malicious email. And Arrigo Automotive Group, based in West Palm Beach, is not alone: Dealership advisers say hackers who lock down an organization's computer system in exchange for a ransom demand are getting more sophisticated, and they're increasingly targeting dealerships.

Arrigo called his experience a cautionary tale and urged dealerships to take the threat seriously.

"We've always heard all these horror stories" about cyberattacks, Arrigo, the group's president and owner, told Automotive News. "You never would have thought it would have happened to you. How in the world do they select you?"

It's an escalating problem.

Crowe LLP, an accounting and consulting company that works with dealerships, has at least six dealer clients that have experienced ransomware attacks in the past 10 months, Anthony Allison, a Crowe partner, said last week. That number is up significantly compared with the previous year or two.

Helion Technologies, a dealership IT consulting company, is contacted about a successful dealership ransomware invasion about once a month, said Erik Nachbahr, its president. Ransomware has gained attention as more people openly discuss it, he said.

In the past six months, Proton Technologies, a dealership IT consulting group, has worked with the FBI on three ransomware cases, CEO Brad Holton said. Proton is working with Arrigo's group to rebuild its system.

At least four city governments reportedly were hit this month alone, including New Orleans.

Businesses also are targets, and IT consultants say dealerships are vulnerable in part because they often run outdated software and don't invest in robust enough safeguards.

For Arrigo, the attack came in what he described as the group's busiest sales month. No employee or customer data was accessed, he said.

He doesn't know why his dealerships were targeted, but he knows how the hackers got in: An unsuspecting employee in the business development center opened what appeared to be an innocuous email sent by a colleague.

When the problem was discovered Dec. 9, computers were down at all of his stores, preventing employees from selling or repairing vehicles.

"It activated a series of malicious tools," Holton said of the email. Hackers then "encrypted every single server on the network at all their stores. The point of it was to basically bring the dealership to a grinding halt so that they would then be forced to pay ransom to get the dealership working again."

But Arrigo didn't pay. He and Holton both said they did not open the ransom demand from the hackers and instead forwarded it to the FBI. They don't know how much money the hackers wanted. Generally, Holton said, ransomware demands start at $1 million and go up, based on the hackers' perceived value of the system.

A spokesman for the FBI's Miami field office said the agency does not confirm or deny such investigations as a policy matter.

Holton said the decision not to pay in Arrigo's case was easy because all of the group's critical data had been backed up and the system could be rebuilt. That calculus might change if a company stood to lose everything, he said.

Dealerships' vulnerability to ransomware starts from the way dealers view IT — "as an expense to be controlled" rather than an investment, Nachbahr said. That can result in computer systems without strong protections and that are vulnerable to hackers.

Arrigo said his company ordered 250 new computers at a cost of at least $260,000. Holton said the final hard costs of upgrading the Arrigo group's systems should not exceed $500,000.

But that doesn't count the indirect costs that stem from the business interruption, including lost sales and service revenue.

Arrigo said he can't accurately estimate it yet, but "I would imagine it's a big number."

Aside from technology upgrades, experts say employee training is critical to prevent ransomware attacks. Some dealership groups conduct regular phishing exercises in which employees are sent emails with links they shouldn't click on. If they do, the employees are routed to cybersecurity training materials.

Arrigo said his dealership group has reminded employees to contact an IT staffer if they click on an email and something strange happens. The group also will review email best practices at other dealerships.

His message to other dealers: This could happen to you.

"I would tell everybody that if you think you're locked down tight enough, I would definitely get some professionals to make sure you are," Arrigo said, "because nobody would ever want to go through this again."