Massive Cyberattacks Are Hitting More Than 15,000 Dealerships Right Now

Plainfield Circa September 2020: Chevrolet Automobile Dealership. Chevy Is A Division Of General Motors And Makes The Silverado, Camaro And Impala.
ADVERTISEMENT

If you’re looking at buying a car over the next 24 hours or so, there’s a good chance that process got much harder, depending on where you’re buying from. CDK Global, the largest provider of dealer management services in North America, has been subject to not one, but two cyberattacks in the past two days, and while the implications for immediate operations at dealerships using the firm’s services are clear, the picture of the total fallout looks murky at best.

On Wednesday morning, CDK Global shut down its services due to what it called a “cyber incident,” plunging more than 15,000 dealerships across North America back into the 1980s. See, CDK is a leading provider of dealer management software, which covers everything from parts invoicing to payroll. Soon after, the firm issued this statement:

Erring on the side of caution, we proactively shut all systems down and executed extensive testing and consulted with external third-party experts. With the work done so far, our core DMS and Digital Retailing solutions have been restored. We are continuing to conduct extensive tests on all other applications, and we will provide updates as we bring those applications back online. Our first priority is always the security of our customers, and our actions reflect our obligation to them as a trusted partner.

By Wednesday afternoon, it seemed like things were clearing up. Automotive News reported that CDK claimed its dealer management system was unaffected by the cyberattack, and service started to be restored. While not every piece of CDK software was back online, things started to look hopeful. The situation started looking less hopeful later that evening, because another cyberattack happened. Here’s the latest statement from CDK, as published by Automotive News:

We are sorry to inform you that we experienced an additional cyber incident late in the evening on June 19th. Out of continued caution and to protect our customers, we are once again proactively shutting down most of our systems.

We are currently assessing the overall impact and consulting with external third-party experts. At this time, we do not have an estimated time frame for resolution and therefore our dealers’ systems will not be available at a minimum on Thursday, June 20th.

Well, that’s not good. As of right now, continuing operations appears to be a scramble. Some dealerships are going back to paper invoices. Others are dealing with phone system issues, given how some use CDK’s customer communications systems. Dealers using Reynolds and Reynolds or Dealertrack are continuing operations as normal, as software from competing firms is unaffected, but still, while the lighting has flashed, the flood is yet to come in. See, the motive and wider effects of these cyberattacks have yet to be released, and depending on how far deep things go, it could affect more than just internal operations.

Honda Dealer Average New Vehicle Transaction Price
Photo credit: yonkershonda licensed under CC BY-SA 2.0

While CDK Global is most known for its dealer management system, it also offers finance and insurance software, including the ability to run credit checks on customers. If a substantial data breach has occurred, information leaks could go far beyond the personal identifying information of dealership employees. Granted, as of Thursday, it’s not known if these cyberattacks exposed customer data, but this is something to hold tight on.

Support our mission of championing car culture by becoming an Official Autopian Member.

Relatedbar

Got a hot tip? Send it to us here. Or check out the stories on our homepage.

About the Author

View All My Posts

71 thoughts on “Massive Cyberattacks Are Hitting More Than 15,000 Dealerships Right Now

  1. plunging more than 15,000 dealerships across North America back into the 1980s.

    I have a mental image of sitting across from William H. Macy wearing a hang-dog expression as I berate him for the surprise addition of an undercoat charge.

  2. plunging more than 15,000 dealerships across North America back into the 1980s.

    I have a mental image of sitting across from William H. Macy wearing a hang-dog expression as I berate him for the surprise addition of an undercoat charge.

  3. Ah, maybe this explains why I couldn’t make a service appointment online yesterday.

    Hmm, or not. Still doesn’t work when I load the page. Guess I’ll have to let my fingers do the walking.

  4. Ah, maybe this explains why I couldn’t make a service appointment online yesterday.

    Hmm, or not. Still doesn’t work when I load the page. Guess I’ll have to let my fingers do the walking.

  5. I purchased a used VW with an extended warranty from a Subaru dealer. I had an appointment this morning for warranty service but was turned around because they could not research any parts or manuals for my car. It looked like they had to turn a few Subies around too.

  6. I purchased a used VW with an extended warranty from a Subaru dealer. I had an appointment this morning for warranty service but was turned around because they could not research any parts or manuals for my car. It looked like they had to turn a few Subies around too.

  7. I expect to see at least one IT guy get sacked for this, potentially more. If they have a CISO (Chief Information Security Office), that person just experienced a resume-generating event.

    1. I can almost guarantee you their IT dept has brought up concerns about security just to be shrugged off as being too expensive to implement. Ask me how I know?

      1. This, for sure. “Now, Mike, why would we spend that money when the likelihood is so small?”

        ”Because risk is not just about likelihood, it’s also about impact. Just record my concerns for the record, Bob.”

        1. IT teams should have a former recall coordinator on staff.

          Wherever I’m going, I’ll be there to apply the formula. I’ll keep the secret intact.

          It’s simple arithmetic.

          It’s a story problem.

          If a new car built by security vulnerability my company found leaves Chicago traveling west at 60 miles per hour, and the rear differential locks up, and the car crashes and burns with everyone trapped inside, could be exploited, does my company initiate a recall patch it?

          You take the population of vehicles vulnerabilties in the field (A) and multiple it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement if it gets exploited(C).

          A times B times C equals X. This is what it will cost if we don’t initiate a recall patch it.

          If X is greater than the cost of a recall patch, we recall the cars patch it and no one gets hurt.

          If X is less than the cost of a recall patch, then we don’t recall patch.”

      2. I’d have the same user name if that happened to me.
        The company I work for got a ransomware attack a few years back. It was amazing the protocols that got put in place after… Thankfully We had good back ups and were only down for a day.

      3. Proactively bringing up issues and being sacked as a scapegoat for someone else’s failing to act on those issues are not mutually exclusive.

    2. Maybe, maybe not.

      “Internal vectors” (IE, knowledgeable employees) are by far the biggest threat for a lot of companies, to the point that many of the cybercrime gangs offer a commission from whatever ransom they get to employees willing to install software. That’ll get HR and the risk management team some grief, and raise some separation-of-duty concerns, but some people can still keep their jobs after failure like this.

      Even past that, a lot of CISO positions are more vendor management than anything else, where software selection and implementation are conducted by third parties.

      Ultimately, C-level hiring decisions fall on the board, and it’ll be lively if the CISO can say “I made recommendations X, Y, and Z, all of which were rejected by the CEO and CTO and would have prevented this.”

      So while I’ve no doubt somebody will get fired, but part of the fun with entities like this is seeing how in-depth the board investigates.

      1. Hadn’t heard the internal vector theory before but not at all surprised.

        The guy who has been ignored for years about all the problems that he know about is likely to be disgruntled. Add some typical corporate “management” that treats them like a cog at the best of times and pretty soon Joe from IT is vacationing in Romania.

        1. Yep. And LinkedIn and AI have made it all the more easy to discover who your potential insiders are. Find a guy who’s been working at the same place for 7+ years without a meaningful title change, somewhere in the bowels of application support or the like, and chances are he knows enough to push malware to a critical app (even these days, people like salesforce.com admins are not likely to have an IT or security-oriented background).

          Cyberinsurance is getting pricier, but a lot of the policies covered 8-figure sums as well as the cost of a third party investigation (that’s useful to determine who you’re going to fire when you’re done). 15% commission on a 10MM policy if you’re an “analyst” pulling down 80k is pretty good. With the advent of bitcoin (among others), it’s even fairly easy (from a tax perspective) to make it look like the money was legitimate.

          It’s one of the reasons old-school tech insiders have significant unease with the notion of interlinked autonomous vehicles. Malicious insiders right now are mostly confined to damaging stuff where the human cost is a secondary or tertiary exposure (IE, if I’m a hospital database admin and take down EPIC, the core problem is in software, there are contingencies for paper charting in place, and it’s a significant inconvenience to the patients in which some might die, but the contingency is adequate on a short-term basis). But if you, as an insider, intentionally compromise how self-driving vehicles operate? You can wreak a considerable amount of havoc directly on people. Combine that with automated OTA updates and the possibilities are kinda horrifying. Almost all autonomous systems these days require human judgment in the processing loop (piloting aircraft, medicine, train operation, drone flight, etc.), and while that comes with its own set of problems, it’s also a useful failsafe.

      1. Everything works: “what the hell do we pay you guys so much for?”

        Everything broken: “what the hell do we pay you guys so much for?”

  8. I expect to see at least one IT guy get sacked for this, potentially more. If they have a CISO (Chief Information Security Office), that person just experienced a resume-generating event.

    1. I can almost guarantee you their IT dept has brought up concerns about security just to be shrugged off as being too expensive to implement. Ask me how I know?

      1. This, for sure. “Now, Mike, why would we spend that money when the likelihood is so small?”

        ”Because risk is not just about likelihood, it’s also about impact. Just record my concerns for the record, Bob.”

        1. IT teams should have a former recall coordinator on staff.

          Wherever I’m going, I’ll be there to apply the formula. I’ll keep the secret intact.

          It’s simple arithmetic.

          It’s a story problem.

          If a new car built by security vulnerability my company found leaves Chicago traveling west at 60 miles per hour, and the rear differential locks up, and the car crashes and burns with everyone trapped inside, could be exploited, does my company initiate a recall patch it?

          You take the population of vehicles vulnerabilties in the field (A) and multiple it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement if it gets exploited(C).

          A times B times C equals X. This is what it will cost if we don’t initiate a recall patch it.

          If X is greater than the cost of a recall patch, we recall the cars patch it and no one gets hurt.

          If X is less than the cost of a recall patch, then we don’t recall patch.”

      2. I’d have the same user name if that happened to me.
        The company I work for got a ransomware attack a few years back. It was amazing the protocols that got put in place after… Thankfully We had good back ups and were only down for a day.

      3. Proactively bringing up issues and being sacked as a scapegoat for someone else’s failing to act on those issues are not mutually exclusive.

    2. Maybe, maybe not.

      “Internal vectors” (IE, knowledgeable employees) are by far the biggest threat for a lot of companies, to the point that many of the cybercrime gangs offer a commission from whatever ransom they get to employees willing to install software. That’ll get HR and the risk management team some grief, and raise some separation-of-duty concerns, but some people can still keep their jobs after failure like this.

      Even past that, a lot of CISO positions are more vendor management than anything else, where software selection and implementation are conducted by third parties.

      Ultimately, C-level hiring decisions fall on the board, and it’ll be lively if the CISO can say “I made recommendations X, Y, and Z, all of which were rejected by the CEO and CTO and would have prevented this.”

      So while I’ve no doubt somebody will get fired, but part of the fun with entities like this is seeing how in-depth the board investigates.

      1. Hadn’t heard the internal vector theory before but not at all surprised.

        The guy who has been ignored for years about all the problems that he know about is likely to be disgruntled. Add some typical corporate “management” that treats them like a cog at the best of times and pretty soon Joe from IT is vacationing in Romania.

        1. Yep. And LinkedIn and AI have made it all the more easy to discover who your potential insiders are. Find a guy who’s been working at the same place for 7+ years without a meaningful title change, somewhere in the bowels of application support or the like, and chances are he knows enough to push malware to a critical app (even these days, people like salesforce.com admins are not likely to have an IT or security-oriented background).

          Cyberinsurance is getting pricier, but a lot of the policies covered 8-figure sums as well as the cost of a third party investigation (that’s useful to determine who you’re going to fire when you’re done). 15% commission on a 10MM policy if you’re an “analyst” pulling down 80k is pretty good. With the advent of bitcoin (among others), it’s even fairly easy (from a tax perspective) to make it look like the money was legitimate.

          It’s one of the reasons old-school tech insiders have significant unease with the notion of interlinked autonomous vehicles. Malicious insiders right now are mostly confined to damaging stuff where the human cost is a secondary or tertiary exposure (IE, if I’m a hospital database admin and take down EPIC, the core problem is in software, there are contingencies for paper charting in place, and it’s a significant inconvenience to the patients in which some might die, but the contingency is adequate on a short-term basis). But if you, as an insider, intentionally compromise how self-driving vehicles operate? You can wreak a considerable amount of havoc directly on people. Combine that with automated OTA updates and the possibilities are kinda horrifying. Almost all autonomous systems these days require human judgment in the processing loop (piloting aircraft, medicine, train operation, drone flight, etc.), and while that comes with its own set of problems, it’s also a useful failsafe.

      1. Everything works: “what the hell do we pay you guys so much for?”

        Everything broken: “what the hell do we pay you guys so much for?”

  9. Maybe, just hear me out here, MAYBE we shouldn’t allow whole industries to be managed by 1-3 companies like this? Especially, when vehicles are almost a utility at this point?

    1. We probably didn’t originally, but as larger companies swallow up smaller companies this is eventually what happens, then there becomes a lack of choice where to get services from.

    2. Fewer companies means less economic pressure to do things like offer a competitive product, or pay employees a competitive wage. That’s a win-win for the ownership class. Think of all the wins that are going to trickle down to us someday!

    3. Counterpoint: cybersecurity is super hard and only a decent size org has a chance.

      That assumes that any org tries, or that anyone anywhere really has a chance.

  10. Maybe, just hear me out here, MAYBE we shouldn’t allow whole industries to be managed by 1-3 companies like this? Especially, when vehicles are almost a utility at this point?

    1. We probably didn’t originally, but as larger companies swallow up smaller companies this is eventually what happens, then there becomes a lack of choice where to get services from.

    2. Fewer companies means less economic pressure to do things like offer a competitive product, or pay employees a competitive wage. That’s a win-win for the ownership class. Think of all the wins that are going to trickle down to us someday!

    3. Counterpoint: cybersecurity is super hard and only a decent size org has a chance.

      That assumes that any org tries, or that anyone anywhere really has a chance.

  11. Yeah that’s gonna be bad if they get access to the customer data. Just think about all the information you have to give up to buy a car.

  12. Yeah that’s gonna be bad if they get access to the customer data. Just think about all the information you have to give up to buy a car.

    1. Same concern here, we just bought a 2023 Civic Si about a month ago. I’m sure they didn’t secure the data since the dealership can’t even handle a sales transaction correctly.

    1. Same concern here, we just bought a 2023 Civic Si about a month ago. I’m sure they didn’t secure the data since the dealership can’t even handle a sales transaction correctly.

Leave a Reply