The aftermath of the CDK Global cyberattack continues to linger, with many car dealerships in the U.S. still grappling to return to normal operations almost two weeks after the incident. The cyberattack, which targeted CDK Global, a key software provider for around 15,000 auto dealerships in the country, has caused millions of dollars in losses for dealers as they struggle to track customer interactions, orders, and sales.
Initially reported on June 19, 2024, CDK Global fell victim to a cyberattack, with subsequent disclosures revealing that the company faced twin attacks within the same week. Major clients of CDK Global, such as General Motors dealerships, Group 1 Automotive, Asbury Automotive Group, AutoNation, Lithia Motors, Penske, Sonic Automotive, and Holman, were significantly impacted by the cyber incident. These dealerships heavily rely on CDK’s software to manage daily operations ranging from sales transactions to inventory management.
As a result of the cyberattack, some dealerships resorted to manual methods using pen and paper to fulfill orders, while services like state inspections, repairs, and parts deliveries came to a halt in certain regions of the country. CDK Global took swift action by shutting down most of its systems to investigate the incident and restore operations, emphasizing their commitment to resolving the issue promptly for their customers.
In response to the cyberattacks, several affected firms activated their incident response plans and disconnected from CDK systems as a precautionary measure. Sonic Automotive, for instance, expressed uncertainty regarding the extent of customer data accessed by the attackers, while Lithia Motors highlighted ongoing negative impacts on its operations and financial condition. Penske Automotive reported that the ransomware attack primarily targeted its truck dealership business, prompting the implementation of business continuity plans to sustain operations.
A study by the Anderson Economic Group estimated that the cyberattacks on CDK Global could potentially lead to nearly $944 million in direct losses for affected car dealers if the outage prolongs for three weeks. CDK Global, in a recent automated voice message to its clients, acknowledged the ongoing efforts to restore operations but anticipated a resolution by July, with updates being provided as progress is made.
While the challenges posed by the cyberattack persist, the affected dealerships continue to work towards resuming normal business operations and mitigating the financial repercussions of the incident. The incident serves as a stark reminder of the cybersecurity threats facing the automotive industry and the imperative for enhanced protective measures to safeguard sensitive data and ensure operational continuity for businesses in the digital age.