The real cost of threats in the automotive industry

The extended supply chain as an unprotected entry point

In an ecosystem where modern vehicles are essentially “computers on wheels” and smart factories are hyper-connected, an organization’s security posture is only as strong as its weakest supplier. Attackers rarely waste time trying to breach a heavily fortified OEM directly. Instead, they target Tier-1, Tier-2, or even Tier-3 software, component, and engineering vendors.

This challenge becomes even more acute when collaborating with external engineering design or crash-testing partners, where organizations must ensure shared validation records remain secure. In our research, nearly 2 out of every 3 respondents mandate strict controls either requiring partners to hold recognized industry certifications like TISAX or ISO 27001 or forcing all shared data to reside exclusively on internal, audited collaboration platforms, or both options at the same time.

The real-world use cases of supply chain fallout

Recent real-world events demonstrate why supplier security must be taken seriously. In April 2026, Japanese automaker Nissan confirmed a cybersecurity incident involving a third-party vendor. Threat actors from the Everest group claimed to have infiltrated a file transfer system used by a vendor supporting North American Nissan and Infiniti dealerships, exfiltrating 910 GB of data, including customer and dealership information, according to The Record.

While a Nissan spokesperson noted that they ‘found no indication that Nissan systems were compromised or that any Nissan customer information was accessed or put at risk,’ the incident highlights the ongoing operational and reputational risks associated with extended supply chains.

A month earlier, before the Nissan cybersecurity incidents, in March 2026, Mazda Motor Corporation disclosed a security breach involving an internal warehouse management system for Thailand-sourced parts. As Bleeping Computer stated, the incident exposed 692 records containing professional contact details and IDs for employees and business partners, though no customer data was compromised. While Mazda confirmed no misuse has been detected, it urged affected individuals to stay alert for potential phishing scams.

Another use case? According to Reuters, in 2024, a group of hackers launched a ransomware cyberattack on SaaS provider CDK Global, demanding millions in ransom to restore its software systems. The multi-day outage forced over 15K auto dealerships across North America to revert to manual business continuity processes, severely disrupting sales, financing, and service operations. Some auto reteller groups like Sonic Automotive and Penske Automotive reported hits to their operations. It highlights the vast supply chain risks tied to third-party dealer management platforms.

As these incidents show, relying on third-party tools can lead to severe operational disruptions and data breaches. In our research, we’ve found that while just 26% of respondents have implemented modern Zero Trust Network Access for operational technology, an alarming 37% still rely on high-risk access methods, like granting permanent, unrestricted corporate VPN access, or using generic, shared vendor accounts with minimal logging.

Code repository vulnerabilities and SBOM visibility

Compounding this issue, immediate visibility into software dependencies is surprisingly rare. Only 31% of respondents can instantly track a compromised component using an automated, centralized Software Bill of Materials. The vast majority - 44.5% - face a 24-to-48-hour delay lost to manual documentation searches, and 12% require a full week of organizational back-and-forth. Worse yet, 1 in 8 leaders admit they have no way to map specific vendor code to vehicle systems, leaving component tracking entirely in the hands of third parties.

Operational resilience and the real cost of ransomware

Ransomware groups have become increasingly aggressive in recent years. Threat actors no longer just encrypt operational data; they leverage double extortion by threatening to leak sensitive corporate records if their demands are ignored. Automakers have become prime targets because their Just-In-Time manufacturing models cannot tolerate operational downtime, where an outage costs millions of dollars per hour.

In our research, we asked automotive professionals how prepared local plant managers are to maintain assembly line operations if their Manufacturing Execution System is frozen by a ransomware attack.

The results expose a concerning gap in operational resilience: 55.5% of respondents admitted they are only moderately prepared or not prepared at all. This reveals that for many organizations, disaster recovery plans exist only on paper, or are completely absent when facing a live ransomware scenario.

Furthermore, 12% of respondents disclosed that their backups remain connected to the primary network or that they lack a centralized backup system for engineering designs and manufacturing configurations altogether, leaving them highly vulnerable to lateral ransomware propagation.

Real-world incidents underscore the devastating consequences of these security gaps. Thus, in 2024, Hyundai Motor Europe suffered a cyberattack by the Black Basta ransomware gang, which claimed to have exfiltrated 3 TB of corporate data. The disruption was initially described as an IT issue; Bleeping Computer later reported that internal folder structures leaked online revealed that sensitive files across legal, HR, sales, accounting, and IT departments were exposed.

Another, more recent loud ransomware attack was in 2025; British luxury automaker Jaguar Land Rover suffered two major cyber incidents. First, in March 2025, the attackers from the HELLCAT ransomware group accessed JLR’s Atlassian Jira environment using credentials harvested years earlier via infostealer malware. According to Cyber Security News, those credentials remained valid long after the initial compromise; attackers managed to exfiltrate roughly 350 GB of data, including internal documents, source code, Jira issues, and employee records.

Later the same year, JLR suffered another cyberattack that compromised sensitive payroll, benefits, and personal data belonging to current and former personnel. According to Technadu, the incident forced a factory shutdown lasting over a month, resulting in a financial shortfall exceeding $890 million and causing ripple effects throughout the broader UK automotive supply chain.

The razor-thin survival window

Downtime remains one of the most critical threats facing the automotive industry. Given the sector’s heavy reliance on JIT schedules, 95.5% of organizations cannot survive more than three days of operational downtime before facing severe dealership penalties and unrecoverable financial losses.

In fact, nearly 1 in 5 respondents face an immediate crisis within two hours of an outage. Another 39.5% can only survive between 2 and 12 hours before downstream distribution networks break down. Meanwhile, 28% can stretch downtime to 12–24 hours using physical inventory buffers, and 8.5% can tolerate 1 to 3 days of minor delays. Only 4.5% of companies operate business models detached enough from tight schedules to withstand outages beyond three days.