What should a dealership do after a software vendor data breach?

Establish scope in writing

Which systems, which records, which fields, which date range, which rooftops. Verbal reassurance from an account manager is not a scope statement. Request written confirmation and keep it.

Check what your contract already required

Notification timeframes, cooperation obligations, indemnity, audit rights and remediation commitments are either in the agreement or they are not. This is the moment those clauses either work or reveal that they were never negotiated.

Preserve the record

Keep the communications, the timeline and your own actions. Whatever follows, customer notification, insurance, regulatory contact, depends on an accurate account of who knew what and when.

Then fix the class, not the instance

After the immediate response, revisit vendor oversight: which other providers hold similar data, whether their security review is current, and whether the same contractual gap exists across the estate.

The first day

Identify who is responsible internally and bring in the people needed: management, the person responsible for information security, legal counsel and the insurance contact. Ask the vendor for a written statement with the timeline and scope.

Keep a log with times of who said what. Avoid public statements or customer messages until the facts and the obligations are clear and reviewed.

Notifications and records

Depending on the data involved and the locations of the people affected, laws and contracts may require notice to customers, regulators, lenders or insurers within set periods. Counsel can identify which apply.

Keep copies of what is sent and when. If the vendor is responsible for notification, ask for confirmation and copies of what it sent on your behalf.

Common mistakes after a vendor breach

Relying on verbal updates, not asking which of your customers were affected, missing contractual deadlines and failing to review other vendors afterwards are the frequent problems. Another is assuming the vendor's liability covers your costs; check the contract's limits. After the event, hold a short review and update the vendor oversight process and the incident plan.

Preparing an incident plan

Write a short plan that names who leads, who is called first, how vendor incidents are reported, where contracts and contact details are stored and which advisers to involve. Test it once a year with a simple scenario. A plan prepared in advance saves hours on the day and reduces the chance of missing a deadline.