CDK Global ransomware attack halted software at 15,000 car dealerships

CDK Global, whose dealer management software underpins day to day operations at roughly 15,000 car dealerships across the United States and Canada, took its systems offline on 19 June 2024 after a cyberattack. Some services were briefly restored before a second intrusion forced the company to shut its IT environment down entirely.

The platform handles vehicle sales, financing, service scheduling, parts inventory, payroll and back office accounting, so the outage left dealers writing up deals by hand. Several publicly traded dealer groups disclosed the disruption to the Securities and Exchange Commission, among them Lithia Motors, Group 1 Automotive, Penske and Sonic Automotive. Lithia Motors, Sonic Automotive and Group 1 Automotive each said they had severed connections to CDK as a precaution and found no evidence of compromise on their own systems. Penske said the outage primarily affected its Premier Truck Group and that it had implemented its business continuity response plans.

CDK described the intrusion as a ransom event. CBS News, citing Bloomberg, reported that the attackers demanded tens of millions of dollars. Security researchers and press reports attributed the attack to BlackSuit, a ransomware operation widely regarded as a rebrand of the Royal group. CDK also warned dealers that criminals were calling and emailing them while posing as company staff.

The company told customers restoration would take days rather than weeks, but the shutdown was still in force as the month drew to a close, with dealers reporting sales, funding and registration backlogs.