Act Now: Dealerships May Be Running Out of Time to Recover Cyber Losses

In June 2024, a significant cyberattack disrupted operations at numerous auto dealerships. In the aftermath, dealerships—and many others across various industries—have been grappling with intricate insurance issues tied to cyber losses. Despite strong defenses and protocols, such breaches create a chaotic environment that challenges an organization’s resilience. As dealers focus on restoring systems, retrieving lost data, and working with authorities, it’s vital not to overlook key insurance and recovery measures.

Important Focus Areas for Dealerships After a Cyber Loss

1. ‍Dealer Management System (DMS) Contract Time Constraints: Many DMS agreements include a one-year window for filing recovery claims. It is imperative that dealers thoroughly review their contractual provisions and take timely action to preserve their rights to claim losses.‍
2. Insurance Claim Deadlines: With policies issued last summer approaching expiration, strict adherence to claim reporting deadlines—often 30 to 60 days post-expiration—is essential. Late submissions may constitute policy violations and impede the recovery process.‍
3. Preservation of Critical Data: As time elapses, the likelihood of losing vital records and communications increases. Dealers must retain essential documentation such as customer complaints, internal memos from service and sales staff, and key personnel communications to support the claims process and avoid complications.‍
4. Seasonal Claims Volume Risk: The approaching hurricane season may place significant strain on adjusters and forensic accountants due to an influx of property damage claims, potentially delaying attention to older cyber-related claims. Dealers should proactively oversee their cyber insurance claims to ensure they remain visible and prioritized during high-demand periods.

Managing a Cyber Insurance Claim

For effective financial recovery, auto dealers are advised to:

• Consolidate all claim-related expenditures, including those associated with incident response efforts and system restoration, for submission to the insurer.
• Document and quantify additional operational costs incurred during the cyber incident recovery process.
• Assess lost business income and profit impacts by analyzing historical financial data, market dynamics, and customer sales patterns.
• Prepare and submit insurance claims, maintaining active communication with the adjustment team throughout the resolution process.
• Draft comprehensive proof of loss and supporting narratives as required by claims adjusters.
• Create a detailed account of the cyber incident’s operational impact to assist the adjustment team in accurately evaluating the extent of the loss.

Key Focus Areas for Dealers

Recommended Priorities for Dealerships Following a Cyber Loss:

• Accurately distinguish between actual lost sales and those seemingly deferred.
• Quantify ancillary revenue losses across areas such as parts, service, warranty work, and finance income.
• Identify additional income reductions related to factory incentives and administrative reimbursements.
• Evaluate increased operational costs resulting from reliance on manual processes.
• Interpret the policy’s ordinary payroll clause to support continued employee compensation and retention.
• Incorporate seasonal patterns and special dealership programs into the financial model.

‍