cdk global

massive-car-dealer-ransom-attack-is-mostly-over-after-2-weeks-of-work-arounds

Massive car dealer ransom attack is mostly over after 2 weeks of work-arounds

Cars, cdk global, cyberattack, ransomware / /

CDK Global car dealer outage —

CDK outage likely slumped June auto sales, may have cost more than $600M.

–

Cars lined up, shown at an angle in a row, at a car dealership.

Enlarge / Vehicles for sale at an AutoNation Honda dealership in Fremont, California, US, on Monday, June 24, 2024.

Getty Images

After “cyber incidents” on June 19 and 20 took down CDK Global, a software-as-a-service vendor for more than 15,000 car dealerships, forum and Reddit comments by service tech workers and dealers advised their compatriots to prepare for weeks, not days, before service was restored.

That sentiment proved accurate, as CDK Global last expected to have “all dealers’ connections” working by either July 3 or 4, roughly two weeks’ time. Posts across various dealer-related subreddits today suggest CDK’s main services are mostly restored, if not entirely. Restoration of services is a mixed blessing for some workers, as huge backlogs of paperwork now need entering into digital systems.

Bloomberg reported on June 21 that a ransomware gang, BlackSuit, had demanded “tens of millions of dollars” from CDK and that the company was planning to pay that amount, according to a source familiar with the matter. CDK later told its clients on June 25 that the attack was a “cyber ransom event,” and that restoring services would take “several days and not weeks.” Allan Liska, with analyst Recorded Future, told Bloomberg that BlackSuit was responsible for at least 95 other recorded ransomware breaches around the world.

Lisa Finney, senior manager for external communications at CDK, told Ars on Monday that the firm had no additional information to provide about the attacks, service restoration, or plans for dealers preparing against future attacks.

During the outage, many dealerships pivoted from all-in-one software platforms to pens, paper, Excel sheets, phone calls, and, in some cases, alternative local software. Car Dealership Guy rounded up some of the dealerships’ work-arounds. Repair part numbers, hours, and partial VIN numbers were being tracked in Excel. Lots of dealers grabbed the last contracts they had on hand, blanked out customer information, and made editable PDFs out of them.

Lots of dealers and service managers advocated preparing for the next outage with “no Internet days.” Others noted that the steps some dealerships were taking, like using their own phones for contacting sales leads, could run afoul of privacy and “Do not call” provisions.

Anderson Economic Group, a Michigan-based auto analyst, estimated that CDK’s shutdown cost auto dealers more than $600 million over a two-week period. CDK’s outage is expected to play a large part in a June car sales slump.

Massive car dealer ransom attack is mostly over after 2 weeks of work-arounds Read More »

single-point-of-software-failure-could-hamstring-15k-car-dealerships-for-days

Single point of software failure could hamstring 15K car dealerships for days

Biz & IT, car dealers, car dealerships, Cars, cdk global, crm, ransomware, SaaS, Security, venture capital, VPN / /

Virtual Private Failure —

“Cyber incident” affecting 15K dealers could mean outages “for several days.”

– Updated

Ford Mustang Mach E electric vehicles are offered for sale at a dealership on June 5, 2024, in Chicago, Illinois.

Enlarge / Ford Mustang Mach E electric vehicles are offered for sale at a dealership on June 5, 2024, in Chicago, Illinois.

Scott Olson / Getty Images

CDK Global touts itself as an all-in-one software-as-a-service solution that is “trusted by nearly 15,000 dealer locations.” One connection, over an always-on VPN to CDK’s data centers, gives a dealership customer relationship management (CRM) software, financing, inventory, and more back-office tools.

That all-in-one nature explains why people trying to buy cars, and especially those trying to sell them, have had a rough couple of days. CDK’s services have been down, due to what the firm describes as a “cyber incident.” CDK shut down most of its systems Wednesday, June 19, then told dealerships that evening that it restored some services. CDK told dealers today, June 20, that it had “experienced an additional cyber incident late in the evening on June 19,” and shut down systems again.

“At this time, we do not have an estimated time frame for resolution and therefore our dealers’ systems will not be available at a minimum on Thursday, June 20th,” CDK told customers.

As of 2 pm Eastern on June 20, an automated message on CDK’s updates hotline said that, “At this time, we do not have an estimated time frame for resolution and therefore our dealers’ systems will not be available likely for several days.” The message added that support lines would remain down due to security precautions. Getting retail dealership services back up was “our highest priority,” the message said.

On Reddit, car dealership owners and workers have met the news with some combination of anger and “What’s wrong with paper and Excel?” Some dealerships report not being able to do more than oil changes or write down customer names and numbers, while others have sought to make do with documenting orders they plan to enter in once their systems come back online.

“We lost 4 deals at my store because of this,” wrote one user Thursday morning on r/askcarsales. “Our whole auto group uses CDK for just about everything and we are completely dead. 30+ stores in our auto group.”

“We were on our own server until a month ago because CDK forced us to go to the cloud so we could implement [Electronic Repair Orders, EROs],” wrote one worker on r/serviceadvisors. “Since the change, CDK freezes multiple times a day… But now being completely down for 2 days. CDK I want a divorce.”

CDK benefits from “a rise in consolidation”

CDK started as the car dealership arm of payroll-processing giant ADP after ADP acquired two inventory and sales systems companies in 1973. CDK was spun off from ADP in 2014. In mid-2022, it was acquired by venture capital firm Brookfield Business Partners and went private, following pressure from activist public investors to trim costs.

Brookfield said at the time that it expected CDK “to benefit from a rise in consolidation across the dealership industry,” an industry estimated to be worth $30 billion by 2026. Analysts generally consider CDK to be the dominant player in the dealership management market, with an additional 15,000 customers in the trucking industry.

Under CEO Brian McDonald, who returned to the firm after its private equity buyout, the company pushed most of its enterprise IT unit to global outsourcing firm Genpact in March 2023.

CDK released a report on cybersecurity for dealerships in 2023. It noted that dealerships suffered an average of 3.4 weeks of downtime from ransomware attacks, or potentially an average payout of $740,144 (or even both). Insurer Zurich North America noted in a 2023 report that dealerships are a particularly rich target for attackers because “dealerships store large amounts of confidential, personal data, including financing and credit applications, customer financial information and home addresses.”

“In addition,” the report stated, “dealership systems are often interconnected to external interfaces and portals, such as external service providers.”

Ars contacted CDK for comment and will update this post if we receive a response. As of Thursday morning, the firm has not clarified if the “cyber incident” is due to ransomware or another kind of attack.

This post was updated at 2 pm to note a message indicating that CDK’s outage could last several days.

Listing image by Scott Olson / Getty Images

Single point of software failure could hamstring 15K car dealerships for days Read More »