Ransomware attacks on the auto industry more than doubled in 2025 and the weakest entry point is not where you think

Summary: # Summary

Ransomware attacks on the automotive industry more than doubled in 2025, now representing 44% of all cyber incidents in the sector, according to the Halcyon Research Institute. Cybercriminals exploit connected vehicles, APIs, and cloud systems, with smaller third-party suppliers serving as common entry points. Organized groups employ Ransomware-as-a-Service models and AI tools. Recent major breaches caused significant disruptions: a Jaguar Land Rover attack halted production for three weeks with estimated $2.5 billion losses, and a CDK Global incident shut 15,000 dealerships for two weeks, costing approximately $1 billion.