More likely in this case the individual dealer was compromised. It’s been a few years and I doubt much has changed but smaller to mid sized dealer IT networks are an an absolute dumpster fire. No one at the dealer wants to put money into something that isn’t directly adding to profit. Plus the computer skills of the average employee are at the bottom of the barrel.