Between 10:34 p.m. on Sept. 8 and 10:50 p.m. on Sept. 29, someone logged into GeNesys, a dealer management platform used by hundreds of German car dealerships, and copied out the paperwork behind their sales: order and invoice numbers, delivery dates, purchase prices, financing amounts and, at some stores, the buyer’s VIN and the name of the salesperson who closed the deal.
No dealership closed and no service lane went dark, which separates this breach from the CDK Global attack that sent North American dealers back to pen and paper in June 2024. CDK was a shutdown that cost dealers. This one leaves the stores running and hands the bill to buyers, because the stolen fields are the exact details a fraudster needs to send a convincing “please pay the balance to our new account” message in the weeks before a car is handed over.
Who runs GeNesys and what was copied
GeNesys is sold by Achter Autohaus Software GmbH, a small company in Rödelsee, near Würzburg in northern Bavaria. Its reference page claims more than 400 businesses across Germany use the software, and the customer logos on that page include Audi AG and several Porsche centers. Volkswagen confirmed to the German news agency dpa that the software is also used by Volkswagen Group Retail Deutschland, the automaker’s own retail arm, which runs about 120 dealerships in Germany. According to dpa’s Oct. 14 report, the affected dealers mainly sell Volkswagen Group brands, though not exclusively. Police confirmed to dpa a cyberattack on an IT service provider in the Würzburg area and said the number of affected customers is not yet known. They had no evidence of fraud attempts so far.
The most detailed account so far comes from the dealers themselves, who under European privacy law have to tell their customers. A notice that the dealer group Kuhn+Witte emailed to customers, published by German IT-security blogger Günter Born on Oct. 10, gives the September access window above and says the provider spotted the intrusion on Sept. 30. Achter then cut off access, replaced keys and certificates, changed the password on the affected service account, filed a criminal complaint on Oct. 1 and reported the incident to the Bavarian data protection authority, the BayLDA. At least 3,374 records belonging to that one dealer were identified as retrieved, and the dealer is treating its entire stored data set as potentially exposed. The notice says there was no sign that anything was altered or deleted.
A second notice, from the dealer Eichbichler and also published by Born, lists the fields at risk: names, addresses, customer and contract numbers, vehicle model and VIN, the salesperson’s name, payment and financing amounts, delivery date, email address and phone number.
How the attackers got in is still disputed. The Kuhn+Witte notice says they used login credentials they had obtained. Police told dpa the attack ran through third-party software with a serious security flaw. Both can be true if a flaw leaked the credentials, but nobody has said so on the record. When I checked Achter’s own website on Oct. 15, it carried no notice of the incident.
Why a deal file is worth more to a scammer than a password
Most consumer data leaks hand criminals names and email addresses, which buys them generic phishing that many people delete on sight. A dealer management system holds something rarer: the live state of a transaction. It knows that a specific person owes a specific dealership a specific sum, which bank is financing the rest, who the salesperson is and the week the car is due.
Every check a careful buyer would run against a suspicious email is a check against those fields. Does it have my order number? Is the balance right? Is that my salesperson? Is the date right? A message built from a GeNesys export passes all four, then asks for the one thing that is false: a new account number. Fraud investigators call this payment-redirect or business email compromise fraud, and it usually targets companies paying suppliers. The FBI’s 2025 Internet Crime Report logged 24,768 business email compromise complaints in the United States with reported losses of $3,046,598,558. The GeNesys data points the same technique at private car buyers, who have no accounts-payable department to catch it.
The financing amounts open a second route. A caller who knows the size of your loan and the name of your lender can pose as the bank and ask you to “confirm” account details. That is why the dealer notices warn about fake calls as well as fake invoices.
Europe’s new IBAN name check catches the crude version
German buyers have a defense that did not exist a year ago. Since Oct. 9, 2025, every bank in the euro area that offers transfers has had to run a free payee check under Article 5c of Regulation (EU) 2024/886, the instant-payments law. Before the money leaves, the sending bank compares the name the customer typed with the name on the account behind the IBAN. As Commerzbank’s customer guide lays out, the answer comes back as a match, a close match (with the correct name offered), no match, or a check that could not be completed.
If a fraudster sends a buyer to an account he controls and the buyer types in the dealership’s name, the bank should flag a mismatch, since opening an account in the dealer’s company name means getting past the bank’s identity checks. The weakness is in the name itself. The check confirms that the name you typed belongs to the account. It cannot tell you that the name belongs in your car deal. A message that says the balance should go to a “logistics partner,” an escrow service or the financing bank’s “collection account” can give a payee name that matches a real mule account perfectly. The check also produces only a “could not be completed” result for accounts outside the EU and European Economic Area. Commerzbank’s guide warns that authorizing a transfer after a mismatch could send the money to an account whose holder is not the payee you named, and dpa’s report advised buyers to take such bank warnings seriously.
Americans do not have this check at all. Under Section 4A-207 of the Uniform Commercial Code, which governs wire transfers in every state, when the name and account number on a payment order point to different people, the receiving bank may rely on the number alone if it does not know of the conflict. On an American wire, the account number decides where the money lands, and the name on the form carries little legal weight.
One breach, a separate warning letter from every affected dealer
The warnings are reaching buyers from dealers rather than from Achter because of how the EU’s General Data Protection Regulation divides responsibility. The software company is a processor, handling data on the dealers’ behalf. Article 33(2) requires it to tell each dealer without undue delay. The dealers are the controllers: Article 33(1) gives each of them 72 hours, where feasible, to report to the regulator, and Article 34 requires them to tell customers directly, without undue delay, when a breach is likely to pose a high risk to them.
In practice, one intrusion can become hundreds of separate letters, each written and sent on its own dealer’s schedule. Born reported that a Franconian VW, Audi and Cupra dealer group learned of the incident on Oct. 9, nine days after Achter detected it, and the Kuhn+Witte email went out before Born’s Oct. 10 post. A buyer who changed email addresses after signing, or whose dealer is slow, may hear about the breach after hearing from the scammer. Both messages arrive from what looks like the same dealership.
CDK hit dealers; this one lands on customers
The CDK attack on June 19, 2024 was disruptive by design. CDK said it served more than 15,000 retail locations in North America, and public dealer groups filed disclosures such as Lithia Motors’ 8-K, which reported disruptions to its CDK-hosted dealer management system while saying it had found no compromise of its own systems. The follow-on fraud was aimed at dealers: CDK warned that bad actors were contacting customers while posing as CDK representatives to gain system access. The GeNesys intrusion ran for three weeks without anyone noticing, which fits a thief who wanted the data rather than the disruption. The downstream fraud points outward, at the people who bought the cars.
Both cases come back to concentration. A dealer that once kept deal jackets in a filing cabinet now keeps them in a vendor’s cloud tenant, next to hundreds of other dealers’ files, behind a handful of administrator and service accounts. We have covered how hard it is for dealers to get out of dealer management system contracts, and why ransomware drives so much of the industry’s security spending. A small regional vendor rarely has the security staff of a CDK or a Reynolds, yet its customer list can reach the manufacturer’s own retail arm. The German motor trade association ZDK is now asking for a task force on organized crime in car sales at the Federal Criminal Police Office, the BKA, according to dpa.
What buyers with an open order should do before delivery day
The risk is highest for anyone whose car has not been delivered or whose final payment has not been made, because the stolen delivery dates tell a scammer when a payment request will look routine. Treat any change in bank details as fraud until your salesperson confirms it on the phone, using the number printed on your purchase contract, not one from the email. When paying, type the payee name exactly as it appears on the contract and stop if the bank reports anything other than a match. Be most skeptical of any request to pay a third party or to pay early. If money has already gone to an account you now doubt, call your bank at once; dpa’s report gives the same advice. American buyers get the same playbook with less help, since their bank will not check the name at all.
Three things will show how bad this gets: whether police begin reporting completed frauds that cite real GeNesys order data, whether the BayLDA opens a formal proceeding against Achter or any dealer, and whether Achter or the police say how the attackers got in. Until one of those comes out, nobody outside the investigation knows how many dealers’ customers are in the stolen files.
If your dealer emailed you new bank details two weeks before delivery and the message had your correct order number and balance, would you pay, or would you call first?