Cyberattack hits car dealerships across the U.S.
Add Axios as your preferred source to
see more of our stories on Google.
Workers stand in a service bay at an auto dealership in Chicago, Illinois, on Thursday following the cyberattack on CDK Global. Photo: Scott Olson/Getty Images
Auto retailers across the U.S. and Canada face potentially days of outages due to back-to-back cyberattacks this week on CDK Global, a software provider with 15,000 car dealerships in North America, per Automotive News.
Why it matters: Cybersecurity breaches have a domino effect, as hundreds of organizations this year faced service disruptions due to a singular attack on a third-party vendor, Axios Codebook author Sam Sabin notes.
- Car dealerships across the U.S. reverted to using pen and paper to process auto repairs and new vehicle sales this week as CDK worked to bring its systems back online following the attacks that began on Wednesday.
Driving the news: CDK shut down its systems as it investigated the first "cyber incident," according to a statement company spokesperson Lisa Finney shared with Axios via email on Thursday night.
- The company's core dealership management system and digital retailing solutions were restored on Wednesday afternoon, but the statement said late in the evening CDK "experienced an additional cyber incident" and "proactively shut down" most of its systems.
State of play: BMW North America told Reuters the CDK outage was "impacting automotive dealerships across the U.S. and Canada, including a portion of BMW Group dealers."
- Companies including Kia, Toyota and Stellantis, which makes Jeep and Dodge vehicles, had helped with ways to assist in serving customers during the CDK outage and Ford said it's been "able to receive sales and service support due to alternative processes available to our dealers," per CNN.
In Michigan, Todd Szott, dealer partner at Szott Auto Group in metro Detroit, said he'd managed to keep his stores open after finding workarounds, but noted the "CVR system that we use at the dealership to register plates is down," per Automotive News.
- His understanding was that "CDK basically runs that system" for the state.
- "We can't do the final paperwork with CDK down, or we can't do the title work with the CVR system down," added Szott, who is president of the Detroit Auto Dealers Association.
- "Now we could go to Secretary of State manually, but ... at this point, we are not hand-typing any of the final paperwork."
What we're watching: CDK sent a note to customers on Thursday saying that it did "not have an estimated time frame for resolution and therefore our dealers' systems will not be available likely for several days."
- The company said in the statement shared with Axios that it was "assessing the impact" of the incident and providing regular updates to customers in partnership with third party experts.
- "We remain vigilant in our efforts to reinstate our services and get our dealers back to business as usual as quickly as possible," the statement added.
Zoom out: Cyberattacks have more than doubled since the COVID pandemic began, per an April International Monetary Fund report that warned the risk of extreme losses from cyber incidents was increasing.
- Microsoft is among the companies to have been hit by nation-state cyberattacks, and health care organizations have reported a surge in ransomeware attacks in recent months.
Read more: Sign up for Axios Codebook
