How a Cyberattack Took 15,000 Car Dealers Offline
(Bloomberg) -- Roughly 15,000 car dealerships across the US and Canada have gone days without software systems crucial to running their business, following multiple cyberattacks on CDK Global. The company is one of just a handful of dealer management system providers that underpin auto retailers’ ability to access customer records, schedule appointments, handle car-repair orders and complete transactions, among other tasks. CDK has confirmed that it’s been the subject of a cyber-ransom event, and Bloomberg reported that the company was planning to pay the tens of millions of dollars that the group behind the hacks had demanded in order to restore service.
1. How did this all start?
CDK’s systems first went down around 2 a.m. Eastern time on June 19, on what otherwise would have been a busy day for dealers because of the Juneteenth national holiday. The company told its customers that it had experienced a cyber incident and had shut down a majority of its systems. After briefly restoring some of its services around midday, CDK informed dealers of a second attack and shut its systems back down.
2. What does CDK do for dealers?
CDK says its core product — called a dealer management system, or DMS — is “the engine” that drives auto retailers’ operations. The use of its software is far-reaching: 2.6% of US gross domestic product is transacted through the company, according to its website. CDK supports dealers in generating sales leads and engaging with prospective car buyers, facilitating trade-ins, arranging auto loans and registering new vehicles. It also offers tools to keep track of replacement parts and schedule service appointments. Ironically, the company marketed itself to dealers as a protector against cyberattacks.
3. How are car dealers coping?
Dealers are still drawing some foot traffic to their stores and haven’t completely shut their doors. But overall activity is much slower than usual, partly because of the longer time it takes to complete tasks using old fashioned pen and paper. Some are switching to using alternative vendors, but that also takes time and doesn’t help dealers who are processing existing transactions and have been locked out of the work they need to do to close deals.
Used Ford vehicles at a dealership in Colma, California, US.
4. What other companies are affected by these hacks?
CDK agreed in April 2022 to be acquired by the investment company Brookfield Business Partners, which paid about $8.7 billion in cash. Brookfield’s stock plunged in the days after the cyberattack, and shares of publicly traded dealership chains including AutoNation Inc., Group 1 Automotive Inc. and Sonic Automotive Inc. also slumped. There’s speculation that the attack and the disruption it’s caused will lead some dealers to switch from CDK to alternative vendors of dealership management systems, including those of Cox Automotive Inc. and Reynolds and Reynolds Co. The hack is also likely to trigger litigation from dealers and consumers. Many of the world’s biggest automakers have confirmed their dealers use CDK, including General Motors Co., Ford Motor Co., Volkswagen AG, Mercedes-Benz Group AG and BMW AG.
5. Who is behind the attack?
Bloomberg reported on June 21 that the hacking group is believed to be based in eastern Europe, citing a person familiar with the matter who asked not to be identified because the information is private. While CDK hasn’t commented on the identity of the hackers, the company did say in an emailed statement that it’s been in touch with third-party experts and notified law enforcement.
6. How much longer will this go on?
In a June 22 update sent to clients, CDK said that it had begun the process of restoring services, and anticipated that it would take “several days, and not weeks,” to get major applications working again. For automakers and their dealers, every day counts at this time of year — it’s not uncommon for manufacturers to set up incentive programs tied to monthly or quarterly sales quotas.
More stories like this are available on bloomberg.com
©2024 Bloomberg L.P.