The GeNesys breach didn't touch a single vehicle. Attackers sat in a German dealer-management platform from 8 to 29 September and left with VINs, delivery dates, outstanding financing amounts, contact details and the salesperson's name. One dealer alone has identified 3,374 records. That's a pretexting kit, not a privacy incident - and it sits in a layer R155 and R156 don't reach: both bound a vehicle type, not a dealer's software vendor.
https://theautowire.com/2026/10/16/genesys-dealer-software-breach-germany-payment-fraud/
The Auto WireHackers Spent Three Weeks in German Dealer Software and Walked Off With Buyers’ Delivery Dates and Loan AmountsA three-week hack of GeNesys dealer software in Germany exposed buyers' order numbers, delivery dates and loan amounts, the raw material for payment-redirect scams.