CDK Global crippled by cyberattack, disrupting vehicle sales in U.S. and Canada. Here’s a look at what happened and where things stand.

Kaitlin Reilly
·Health and Wellness Staff Writer
Updated ·3 min read
38
CDK Global headquarters.
What to know about the CDK Global cyberattack that's impacting car dealerships. (Getty Creative)

Thousands of car dealerships were crippled this week after CDK Global suffered back-to-back cyberattacks, leading to disruptions in business operations — including sales, financing and payroll systems — across North America.

If you’re looking to buy a vehicle this week, you might be impacted for "several" more days. Here’s what we know.

What is CDK Global — and what happened to the company?

The Illinois-based company, which provides software to around 15,000 dealerships in the U.S. and Canada, was hit with back-to-back cyber incidents on Wednesday. It wasn’t clear how many dealerships were affected.

CDK Global initially reinstated its core dealer management and digital retailing systems — which help car dealerships manage everything from inventory and sales to a streamlined online buying experience — after the first attack. However, it shut down most of its systems after a second “cyber incident."

“CDK experienced a cyber incident on June 19. We promptly launched an investigation with leading third-party experts and notified law enforcement. We have begun the restoration process," spokesperson Lisa Finney told Yahoo News in a statement. "Based on the information we have at this time, we anticipate that the process will take several days to complete, and in the interim we are continuing to actively engage with our customers and provide them with alternate ways to conduct business.”

Thad Szott, whose family owns dealerships in Michigan, explained to the Detroit Free Press that CDK Global is “basically our operating system inside our dealerships that does all of our accounting, supports us working with lease payments, cash prices, look up parts, write up repair orders. Basically, everything that operates inside the dealership on the computer.”

In the meantime, dealerships that use the CDK Global technology will either have to suspend operations (like the sale of cars) or write up reports by hand until the ordeal is resolved. So far, CDK Global has no estimated time for when that will happen.

A group claiming to be the cybercriminals behind the CDK Global attack demanded tens of millions of dollars in ransom and is believed to be based in Eastern Europe, Bloomberg reported.

CDK Global is planning to pay the ransom, according to the news outlet.

According to the Associated Press (AP), CDK Global is still impacted by the cyberattack. A recorded message from CDK on a hotline said the company does “not have an estimated time frame for resolution — and therefore our dealer systems will not be available, likely for several days.” At the time, no customer service was available.

Mike Stanton, president and CEO of the National Automobile Dealers Association, said “dealers are very committed to protecting their customer information and are actively seeking information from CDK to determine the nature and scope of the cyber incident so they can respond appropriately.”

Not every dealership uses CDK Global, so it is possible that this suspension won’t impact you at your auto retailer of choice. It’s also possible for dealerships to circumvent their digital systems and conduct business dealings by hand. Szott said that because of the cyberattacks, his dealership has resorted to doing business the old-fashioned way, operating with paper.

While the cyberattack has impacted dealerships, sales operations continue, companies like Ford, BMW and Stellantis confirmed to AP. Brian Benstock, general manager of Paragon Honda and Paragon Acura in Long Island City, N.Y., told CNN that his selling team “can hand-write a buyer’s order.”