If you’re looking at buying a car over the next 24 hours or so, there’s a good chance that process got much harder, depending on where you’re buying from. CDK Global, the largest provider of dealer management services in North America, has been subject to not one, but two cyberattacks in the past two days, and while the implications for immediate operations at dealerships using the firm’s services are clear, the picture of the total fallout looks murky at best.
On Wednesday morning, CDK Global shut down its services due to what it called a “cyber incident,” plunging more than 15,000 dealerships across North America back into the 1980s. See, CDK is a leading provider of dealer management software, which covers everything from parts invoicing to payroll. Soon after, the firm issued this statement:
Erring on the side of caution, we proactively shut all systems down and executed extensive testing and consulted with external third-party experts. With the work done so far, our core DMS and Digital Retailing solutions have been restored. We are continuing to conduct extensive tests on all other applications, and we will provide updates as we bring those applications back online. Our first priority is always the security of our customers, and our actions reflect our obligation to them as a trusted partner.
By Wednesday afternoon, it seemed like things were clearing up. Automotive News reported that CDK claimed its dealer management system was unaffected by the cyberattack, and service started to be restored. While not every piece of CDK software was back online, things started to look hopeful. The situation started looking less hopeful later that evening, because another cyberattack happened. Here’s the latest statement from CDK, as published by Automotive News:
We are sorry to inform you that we experienced an additional cyber incident late in the evening on June 19th. Out of continued caution and to protect our customers, we are once again proactively shutting down most of our systems.
We are currently assessing the overall impact and consulting with external third-party experts. At this time, we do not have an estimated time frame for resolution and therefore our dealers’ systems will not be available at a minimum on Thursday, June 20th.
Well, that’s not good. As of right now, continuing operations appears to be a scramble. Some dealerships are going back to paper invoices. Others are dealing with phone system issues, given how some use CDK’s customer communications systems. Dealers using Reynolds and Reynolds or Dealertrack are continuing operations as normal, as software from competing firms is unaffected, but still, while the lighting has flashed, the flood is yet to come in. See, the motive and wider effects of these cyberattacks have yet to be released, and depending on how far deep things go, it could affect more than just internal operations.
While CDK Global is most known for its dealer management system, it also offers finance and insurance software, including the ability to run credit checks on customers. If a substantial data breach has occurred, information leaks could go far beyond the personal identifying information of dealership employees. Granted, as of Thursday, it’s not known if these cyberattacks exposed customer data, but this is something to hold tight on.
Support our mission of championing car culture by becoming an Official Autopian Member.
-
There Were More Than 3,000+ Attempts To Hack Dealership’s AI Chatbot This Weekend
-
I Ordered Two Identical Trucks From Two Different Dealers. Here’s Why This Turned Out To Be A Genius Move.
-
Why The Internet Is Going Crazy Over A Photo Of A Longbed Pickup Truck At A Dealership
-
This Handy Website Can Help You Avoid Dealer Markups
-
See If You Can Guess Why C8 Corvettes Keep Falling Off Of Lifts
Got a hot tip? Send it to us here. Or check out the stories on our homepage.
Just took my car in for routine maintenance and everything was handled manually. All the employees looked a little clueless. Could not even print out a copy of what was serviced. Imagine if something like this happens to something really important to daily lives?
Just took my car in for routine maintenance and everything was handled manually. All the employees looked a little clueless. Could not even print out a copy of what was serviced. Imagine if something like this happens to something really important to daily lives?
Now we know what Elon did with all those AI chips he’s been diverting from Tesla.
Now we know what Elon did with all those AI chips he’s been diverting from Tesla.
Funny comments here but this is very serious business. A DMS houses every transaction in sales, parts and service as well as all inventory, payroll and financial reports. It also keeps a chart of accounts which is every account payable or receivable including all checks issued. The amount of sensitive data is as high as you can imagine. Your social security number, credit history, vehicle purchase and service history are all there. The interest rate you paid is there. And if a dealer uses CDK’s credit card processing system, your card number, expiration date and CVV may be kept on file. A dealer’s ability to issue or transfer registrations is impacted if they use the CVR system. Oh, and independents and motorsports dealers use CDK as well, not just new car dealers.
It’s inevitable this would happen to a DMS and CDK is likely just the first one. I worked for another DMS provider which experienced around 4000 hacking attempts every day. CDK was purchased by Brookfield Business Partners a little over a year ago for 8.3 billion and represents only 1% of their total portfolio. It’s rumored this is more than just a hacking attempt, but has actually been hacked and the ransom is 500 million. CDK just announced service will be disrupted for several days which supports this rumor.
Dealer employees have my total sympathy. Not only is their livelihood disrupted, they’ll have to work triple time for several weeks after service is restored, manually entering every transaction.
Funny comments here but this is very serious business. A DMS houses every transaction in sales, parts and service as well as all inventory, payroll and financial reports. It also keeps a chart of accounts which is every account payable or receivable including all checks issued. The amount of sensitive data is as high as you can imagine. Your social security number, credit history, vehicle purchase and service history are all there. The interest rate you paid is there. And if a dealer uses CDK’s credit card processing system, your card number, expiration date and CVV may be kept on file. A dealer’s ability to issue or transfer registrations is impacted if they use the CVR system. Oh, and independents and motorsports dealers use CDK as well, not just new car dealers.
It’s inevitable this would happen to a DMS and CDK is likely just the first one. I worked for another DMS provider which experienced around 4000 hacking attempts every day. CDK was purchased by Brookfield Business Partners a little over a year ago for 8.3 billion and represents only 1% of their total portfolio. It’s rumored this is more than just a hacking attempt, but has actually been hacked and the ransom is 500 million. CDK just announced service will be disrupted for several days which supports this rumor.
Dealer employees have my total sympathy. Not only is their livelihood disrupted, they’ll have to work triple time for several weeks after service is restored, manually entering every transaction.
More like the sixties. Dealerships have been fairly computerized since the seventies.
CDKs statements and actions lead me to think this a ransomware attack and probably involved a massive data breach before encryption began. Just my guess.
More like the sixties. Dealerships have been fairly computerized since the seventies.
CDKs statements and actions lead me to think this a ransomware attack and probably involved a massive data breach before encryption began. Just my guess.
Explains why the dealership couldn’t access their calendar when I called. I needed to get my work truck serviced and they just told me to drop it off whenever. They had no idea on their availability.
Explains why the dealership couldn’t access their calendar when I called. I needed to get my work truck serviced and they just told me to drop it off whenever. They had no idea on their availability.
As a dealership that uses Dealertrack, let me just say…….
Hahahahahahahahahaha!
Seriously though, I hope this doesnt lead to any serious issues for people.
Don’t jinx it. They could be next.
Im counting on it. Would be nice to have a few days off, if im being honest.
I’d rather have a currently broken CDK than “fully functional” dealertrash.
There is a luxury in not being able to miss what I’ve never seen lol
As a dealership that uses Dealertrack, let me just say…….
Hahahahahahahahahaha!
Seriously though, I hope this doesnt lead to any serious issues for people.
Don’t jinx it. They could be next.
Im counting on it. Would be nice to have a few days off, if im being honest.
I’d rather have a currently broken CDK than “fully functional” dealertrash.
There is a luxury in not being able to miss what I’ve never seen lol
I’m in the process of buying a Tesla. The manually entered financing offer went “poof” and the automated financing offer I didn’t want came back. I’m hoping Tesla doesn’t use CDK.
I’m in the process of buying a Tesla. The manually entered financing offer went “poof” and the automated financing offer I didn’t want came back. I’m hoping Tesla doesn’t use CDK.
So if I rush to a Honda dealer I can get a 1985 Prelude?
Subscription free?
So if I rush to a Honda dealer I can get a 1985 Prelude?
Subscription free?
This has Sky Net written all over it. It has started.
Great. It’s been nice knowing you folks.
Skynet doesn’t seem too bad compared to the two that we had to choose from come November.
This has Sky Net written all over it. It has started.
Great. It’s been nice knowing you folks.
Skynet doesn’t seem too bad compared to the two that we had to choose from come November.
I hope some IT person sits the dealer down, draws four squares on a piece of paper, writes some random numbers in each square, then explains why it’s going to cost twice their monthly budget to fix the problem and why they should like it.
Let me take a moment out of my day to say, “Well done, Sir!”
“How much do you intend to pay per month?”
I hope some IT person sits the dealer down, draws four squares on a piece of paper, writes some random numbers in each square, then explains why it’s going to cost twice their monthly budget to fix the problem and why they should like it.
Let me take a moment out of my day to say, “Well done, Sir!”
“How much do you intend to pay per month?”
What’s the software equivalent of TruCoat?
Cloud storage?
I’d say ‘AI managed’ cloud storage. Cloud storage itself is useful, but ‘AI Managed’ adds 0%
What’s the software equivalent of TruCoat?
Cloud storage?
I’d say ‘AI managed’ cloud storage. Cloud storage itself is useful, but ‘AI Managed’ adds 0%
“Have you tried turning it off and on again?
“Have you tried turning it off and on again?
Just booked a service at my local, they use MyKaarma for that type of stuff so it was all good as far as I could tell.
That’s not a DMS. That’s a piece of software that interfaces with the DMS, for stuff like sending quotes to customers.