Covington, Kentucky auto dealership cybersecurity tends to get built around a customer loan, not around the customer's data. And that is the whole problem. In the F&I office a dealer pulls a credit bureau file, an identity-scored application through Dealertrack or RouteOne, a driver's license, a Social Security number, a down-payment ACH authorization, and a signed retail installment contract — all in about forty-five minutes. The FTC treats the dealer as a creditor for exactly that reason, and under the Red Flags Rule every store across the Covington market that extends or arranges credit is legally required to run a written Identity Theft Prevention Program on those covered accounts. Most stores on the I-75 corridor have never written one.
The rule is not a suggestion and it is not new. Failure to maintain a reasonable Identity Theft Prevention Program is actionable under Section 5 of the FTC Act as an unfair or deceptive practice, with civil penalties per violation. The agency has already brought enforcement actions against dealerships for leaving consumer credit files exposed on insecure networks and for failing to log access to covered accounts. In Kentucky, the risk is not limited to a federal fine: KRS 365.732 obligates you to notify the state attorney general and every affected consumer within a reasonable time after a breach of unencrypted personal information, and a dealer that cannot even tell which customer files were touched is facing a notification problem it cannot answer.
The DMS is both the cash register and the weak point
Every payment, every credit pull, every financing contract flows through the dealer management system — CDK Global, Reynolds and Reynolds, or Dealertrack. That consolidation is the single point of failure. A lender pay-off list is a standing target for business email compromise: a compromised DMS or finance-manager mailbox lets an attacker inject a spoofed pay-off letter, and the store wires the payoff to an account it has never verified. The direct dollar exposure from lender-fraud BEC at dealerships runs into the millions industry-wide each year, and Covington stores are not exempt.
One flat network runs the F&I office and the customer Wi-Fi
The most common configuration we still find in dealer network assessments is a single flat LAN carrying the F&I workstations and DMS terminals on the same broadcast domain as the service-drive Wi-Fi, the parts counter kiosk, and the inventory tablets on the lot. A customer's phone on dealer Wi-Fi lands next to the file server holding signed contracts and scanned driver's licenses. Segmentation is the baseline fix: wireless networking with a separate, isolated guest SSID, client isolation on the showroom Wi-Fi, and structured cabling so the F&I and accounting segment physically stays off service and public traffic. Once the money side of the network is off the customer side, a friendly browsing session can no longer pivot into the financing files.
What a defensible program actually looks like
A written Identity Theft Prevention Program does not have to be elaborate, but it has to be real and enforced. It must detect when a covered account is accessed by someone who should not have it, respond to red flags, and be re-evaluated as the dealer's business changes. Controls that actually hold up in an FTC inquiry start with endpoint detection. Managed cybersecurity with SentinelOne EDR and Huntress MDR gives you behavioral detection and 24/7 human review on every F&I workstation and DMS terminal, so a credential-stealing payload gets caught before it reaches the contract files. Fed into a SIEM, that same signal produces the access log the Red Flags Rule and KRS 365.732 both imply — evidence of who touched a file and when, which is exactly the record a dealer has no way to reconstruct after a compromise.
Identity control matters just as much. Microsoft 365 configured with conditional access and enforced multi-factor authentication stops a stolen finance-manager password from being replayed from a foreign IP, and blocks legacy protocols that bypass MFA entirely. Red flags get acted on instead of ignored when every unusual sign-in is flagged at the desk rather than discovered at audit time.
And because the DMS holds the financing records the business cannot live without, tested recovery is non-negotiable. Backup and disaster recovery built on Veeam, with immutable offsite copies and a restore drill you have actually run, converts a ransomware event on the F&I office from a pay-or-rebuild decision into a same-day recovery. The dealers that keep lending through an incident are the ones that proved the restore in advance, not the ones who assumed it.
Physical access tracks the data
The F&I office, the title clerk's desk, and the DMS server closet deserve the same access discipline as the network. Video surveillance and electronic access control on the F&I office and server room give you a record of who touched paper contracts and the physical server — the audit trail insurers and regulators increasingly ask for when red-flag investigations turn into claims.
None of this requires a dealership IT department — just a written program, a segmented network, endpoint and identity controls, and a tested restore. If your Covington store has never written its Identity Theft Prevention Program, or never tested a DMS and contract restore, that is a fixable gap. Contact Titan Tech for a dealership network assessment and an F&I security review before the next credit pull.