FTC Safeguards Rule 2026: What the CDK Global Breach Teaches Auto Dealers About Compliance

If your dealer management system went dark tomorrow morning, could you still sell a car, fund a deal, and prove to the FTC that your customers' data was handled the way your written security program says it is? That is the question most dealer principals were forced to answer in June 2024, and it is still the right way to think about the FTC Safeguards Rule for auto dealers heading into 2027.

The short answer: the FTC Safeguards Rule requires any dealer that finances, arranges financing, or leases vehicles for more than 90 days to run a written information security program with nine required elements, including vendor oversight and a written incident response plan. The CDK Global outage showed that the vendor elements are not paperwork. They decide whether you keep operating.

Why are auto dealers covered by the FTC Safeguards Rule?

Dealers are covered because financing is a financial activity under the Gramm-Leach-Bliley Act. The FTC's June 2025 FAQ for automobile dealers states that a dealer qualifies as a financial institution if it finances or facilitates financing for consumers, or leases vehicles for longer than 90 days. The label on the sign out front does not matter; the activities in the F&I office do.

That classification puts a dealership in the same regulatory frame as other non-bank lenders. The business consequence is that a cybersecurity failure at a dealership is not only an IT outage or a reputational problem. It can become a question about whether the dealer met a federal rule that requires specific, documented controls.

The belief CDK should have retired

The common view in the industry after 2024 was that CDK Global was CDK's problem. The vendor was attacked, the vendor paid the price, and dealers were victims. That framing is understandable, but it misreads how the Safeguards Rule allocates responsibility. The rule treats your service providers as part of your program, and it expects you to have chosen them carefully, written security requirements into the contract, and reassessed them over time.

Here is the more uncomfortable take: most dealers who believed they were "Safeguards compliant" in 2024 had built their program around their own network and treated the DMS as a utility. The rule never allowed that shortcut. In our experience reviewing dealer environments, the DMS, CRM, and F&I platforms usually hold more customer financial data than anything on the dealer's own servers, yet they receive the least scrutiny in the written risk assessment.

What actually happened at CDK Global

On June 19, 2024, CDK notified its dealership customers that it had suspended certain systems in response to a cybersecurity incident. Sonic Automotive's Form 8-K filed June 21, 2024 described disruption to its CDK-hosted dealer management system, which supports sales, inventory, and accounting, and to its CRM. Sonic's stores stayed open on workaround solutions, and the company said it did not yet know whether customer data had been accessed.

Restoration took roughly two weeks. CBS News reported on July 1, 2024 that CDK was still in a phased restoration and expected all dealer customers to have access to its platform by July 4, with some dealers working on pen and paper in the meantime.

The financial damage was measurable. The Register's review of second-quarter dealer disclosures reported that Sonic attributed roughly $30 million in lost pre-tax income to the outage, that AutoNation estimated an EPS impact of $1.55 to $3.99, and that disruptions to lead, inventory, and third-party integrations continued into July. None of those dealer groups had been breached directly. Their exposure came entirely through a vendor.

What does the FTC Safeguards Rule require auto dealers to document?

The rule's nine elements are set out in 16 CFR 314.4 and summarized in the FTC's guide FTC Safeguards Rule: What Your Business Needs to Know. Each one has a direct connection to a vendor outage like CDK's. The table below maps them.

Two items in that list deserve emphasis. The service provider element requires that you select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically reassess them. The FTC's dealer FAQ gives concrete examples: a provider with direct access to your systems should use MFA for that access, and a provider storing and processing customer information for you should encrypt it. If your DMS contract is silent on both, your program has a gap regardless of how strong your own firewall is.

The 5,000-consumer exemption is narrower than many dealers assume

Smaller stores sometimes believe they are exempt from the rule. They are not. Under 16 CFR 314.6, institutions that maintain customer information on fewer than 5,000 consumers are excused from four specific provisions: the written risk assessment, continuous monitoring or annual penetration testing and semiannual vulnerability scans, the written incident response plan, and the annual board report. Everything else still applies, including service provider oversight, MFA, and encryption. Most franchised dealers cross 5,000 consumers quickly once service customers and past deals are counted.

How does the FTC breach notification requirement work for dealers?

Since May 13, 2024, dealers covered by the rule must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information of at least 500 consumers is acquired without authorization. The FTC explained the trigger in its post Safeguards Rule notification requirement now in effect, including that unauthorized access is presumed to mean acquisition unless you have reliable evidence it did not happen.

That presumption matters for vendor incidents. When a DMS or CRM vendor tells you an investigation is ongoing, your 30-day clock may already be running for any of your customers' data on its systems. The requirement is not going away. In its August 25, 2026 Federal Register notice, the FTC proposed extending the reporting requirement's paperwork clearance for three more years and said it received approximately 163 breach notifications in 2025 across the financial institutions it oversees.

The practical point for dealer leadership is that the rule's text has been stable since 2024. What has changed is the amount of evidence the FTC now has about who reports, and how. A dealer that cannot reconstruct what customer data sat with which vendor will struggle to make that 30-day decision with confidence.

What should dealers fix before the next vendor outage?

The impact of a CDK-style event lands in three places at once: revenue stops because deals cannot be funded or recorded, staff costs rise because people work around broken systems, and regulatory exposure grows because nobody is sure what data was touched. A written program that only describes your own network addresses none of those. These are the changes we see make the biggest difference.

• Put your DMS, CRM, and F&I vendors in the written risk assessment by name, with the categories of customer data each one holds and how long it holds them.
• Review vendor contracts against the service provider element: security expectations, MFA for any direct access, encryption of stored data, incident notice timing, and your right to reassess.
• Write a third-party outage scenario into the incident response plan, including who decides to disconnect integrations, how customers are told, and how deals are documented manually.
• Keep a current inventory of every vendor integration and credential so access can be revoked and then re-enabled deliberately after restoration, rather than all at once.
• Brief ownership in the annual written report on vendor concentration, so the board has formally accepted or reduced the dependency.

None of this prevents a vendor from being attacked. It changes how long your stores are disrupted, how much it costs, and whether you can show the FTC that your program anticipated the event. If you are reworking your vendor reviews, our guide to protecting your business from vendor vulnerabilities walks through the contract and assessment questions in more detail, and our breakdown of the real dollar cost of downtime and ransomware can help put a number on the dependency for your board report.

Access and identity are where vendor risk usually enters

Many dealer incidents begin with a shared or stale vendor login, not a sophisticated exploit. That is why the MFA and access-control safeguards matter so much in a dealership, where integrators, OEM portals, and lenders all need some access. Our article on cleaning up IAM, MFA, and privileged access covers how to audit those accounts without breaking the integrations the business depends on.

Dealers are also adopting AI tools for lead handling and customer messaging, which adds new vendors with access to customer data. The same oversight logic applies. Our AI Lab piece on planning for an AI vendor outage and securing exit rights applies the CDK lesson to that newer category of provider.

How Securafy helps dealers with the Safeguards Rule

When we work with a dealer group, we start with the vendor map: every platform that holds customer financial data, what it holds, how it connects, and what the contract says. That map feeds a written risk assessment that names the DMS and CRM explicitly, and an incident response plan that includes a third-party outage scenario with named decision-makers. We can serve as, or support, the Qualified Individual, and we produce the annual written report in language ownership can act on.

On the operational side, we manage MFA and access controls for vendor accounts, keep the integration inventory current, run the testing the rule requires, and rehearse the outage scenario so the first time your team works through it is not the real event. If you want to pressure-test your current plan, our guide to strengthening your incident response plan is a useful starting checklist.

Where To Go From Here

The CDK outage made one thing clear: under the FTC Safeguards Rule, your vendors are part of your program, and your program is only as good as its plan for the day a vendor fails. Start by putting your DMS and CRM providers into your written risk assessment and incident response plan by name.

To keep stores operating through a vendor outage, see how Securafy's business continuity services plan recovery around the systems dealers actually depend on.

If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk your current Safeguards program, vendor exposure, and the fastest path to closing the gaps.