Cybercrime and social engineering’s impact in the automotive industry
Nina Paez, Hannah Hoeflinger
The automotive industry is continuing to embrace innovation. Artificial intelligence, biometric authentication keys, electric vehicles, and other new technologies are changing the car experience for consumers. With the automotive industry increasing its dependency on technology, cyber threats are looking to take advantage.
For companies and cybercriminals, these upgrades can start at the beginning of the supply chain. From manufacturing to purchasing, each stage of the industry is embracing change. Automotive manufacturing brought the moving assembly line; now, robotic technology makes it possible to build a vehicle in 18-35 hours. Meanwhile, customers are moving toward the internet. Between 2018 and 2023 the market size of the online car dealer industry, on average, grew by 5.9%. Newer vehicles are connecting to the internet while growing their autonomous functionality, with self-driving cars projected to reach 1 million units by 2025.
Researchers from Stanford University and a top cybersecurity organization found that approximately 88% of all data breaches are caused by an employee mistake. While there are various weaknesses cyber attackers can use to exploit a business’s security or privacy negligence, human error takes center stage.
Social Engineering
Cybercriminals use social engineering to manipulate or influence someone to gain control over a computer system and steal confidential information. This method can take multiple steps, with the perp studying potential victims, points of entry, and weak security plans. From there, trust is gained (usually through posing as someone in their company), and the criminal can access an individual’s or company’s important data.
How information is accessed can vary, but the method always relies on the human aspect. With vehicles holding over 100 million lines of code to help run their firmware and software, cybercriminals will look for any way to get this valuable information. Cybercriminals can enter through a company’s exposed cybersecurity measures or an employee unprepared for a social engineering attack.
Phishing
With 36% of data breaches at dealerships related to phishing, it’s unsurprising that dealerships rated it their top concern. Phishing is a form of social engineering powered by trust. Usually taking the form of an email, a perpetrator can pretend to be a trusted colleague, business partner, vendor, or client.
If someone gains access to an inbox, they can copy a coworker's communication styles and tamper with email security filters that let false emails in. All it takes is an extra letter or a minor change in the email domain to scam an employee or contractor. Emails come in day in and day out during business operations. It’s easy to understand when someone sees a familiar email and casually opens it without suspecting its content. Still, focusing on the little details of an email can be important in reducing cyber risks. By relying on people’s natural trust, criminals can gain access to an employee’s and, to a greater extent, a company’s valuable information.
One phishing scam came knocking on the door of a Marsh McLennan Agency (MMA) client. After sending funds to a trusted third-party partner, the client quickly received an email from the “partner.” The email noted a mistake on the initial fund, with the dollar amount needing an extra zero added. Naturally, the client, thinking they had made a mistake, sent over the correct, pricier funds. Of course, this email turned out to be cybercriminals posing as the partner to steal money. Thankfully, the client had just renewed their policy with social engineering coverage, which helped them regain half of their loss.
Cyber Extortion
Social engineering and phishing attacks can often lead to cyber extortion demands in the form of ransomware. This method involves cybercriminals demanding payment by threatening various attacks against the victim. Data destruction, exfiltration, and operation shutdowns are just a few things criminals can threaten someone with. A costly attack approach, ransomware across industries is expected to cost victims around $265B annually by 2031, according to Cybercrime Magazine.
Ransomware is especially dangerous in the manufacturing and shipping of vehicles. Cybercriminals know these businesses can suffer major financial costs if they cannot conduct business due to system interruptions or shutdowns. In many cases, these attacks come in the form of fraudulent communication, like email, because of an attacker gaining access through credential phishing.
Whether these criminals will make good on their threats isn’t the point of cyber extortion plans. The goal is to make someone think they will or have already done what they said they would do. Through this method, these criminals can achieve their aim of either receiving money from a company and employee or putting a stop to a company’s operations.
How Marsh McLennan Agency can help
As cybercriminals continue to use social engineering to gain access to your organization’s data, creating the proper plan to cover any potential weaknesses will be key. One of the most important steps is ensuring your company has a multi-factor authentication system. The Federal Trade Commission seems to agree, as displayed in their cybersecurity-focused Safeguards Rule, which requires various industries to develop, implement, and monitor a series of security steps that help protect consumers’ data.
Creating and securing cybersecurity protocols in your automotive business isn’t always as smooth or quick as needed. That’s where MMA comes in. MMA’s Cyber Resiliency Network helps you engage with timely, comprehensive, and actionable information that helps prepare your business for cyber risks. Various partner solutions can help strengthen your understanding of current and potential cybersecurity risks. And our specialists update you on the constantly changing regulatory environment. In addition to helping you prepare for any potential cyber incidents, we offer assistance when cybercriminals manage to break through. Give your organization clear steps to address suspected or actual cyber incidents with our cyber incident response roadmap.
Your industry and cybercrimes are evolving, and so should the cybersecurity you have in place for your business. Grow your understanding of the cybersecurity trends facing your automotive business by reading Marsh McLennan Agency’s Business Insurance Trends report.
To learn more, contact a Marsh McLennan Agency specialist today.
