Over 50% of US Car Dealers Are Shut Down Following CDK Hack Attack

A cyberattack on CDK Global, a major provider of automotive dealership software solutions, has caused widespread disruption, affecting more than half of all car dealerships in the US.

The incident, which began on Wednesday, forced CDK to shut down most of its systems as a precautionary measure, leaving thousands of dealerships unable to access critical applications for sales, financing, and service.

CDK Global, which serves more than 15,000 dealerships in North America, first detected the cyber incident on Wednesday morning.

In response, the company took the drastic step of shutting down its core dealership management system and digital retailing solutions to protect customer data.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot

While some services were restored by Wednesday afternoon, CDK experienced an additional attack late that evening, prompting another widespread systems outage.

The impact on dealerships has been severe, with many resorting to pen and paper to handle sales and service transactions.

Dealership employees reported being unable to schedule service appointments, look up parts, or even print repair orders.

Sales teams have had to fall back on handwritten contracts and, in some cases, have sent staff home due to the inability to access critical systems.

Industry experts note that cybercriminals increasingly target car dealerships due to the wealth of sensitive customer financial data they possess.

A recent CDK Global report found that 17% of surveyed dealerships had experienced a cyberattack within the past year, up from 15% the previous year. Of those affected, 46% said the incident had a negative financial or operational impact.

The CDK attack came just a week after a similar incident affected Findlay Automotive Group, hindering sales and service at the dealership chain.

With the summer months being peak car-buying season, dealerships are scrambling to find workarounds and keep their businesses running.

Statement from Automakers

Automakers like Kia, Toyota, and Stellantis have been working with affected dealerships to help serve customers during the outage.

As of Thursday, CDK informed dealerships that it does not have an estimated time frame for resolving the outage, indicating that systems could remain unavailable for several days.

The company says it is working with third-party experts to assess the attack’s impact and restore services as quickly as possible.

However, the prolonged disruption is likely to have significant financial consequences for dealerships and may drive frustrated customers to competitors unaffected by the CDK incident.

The CDK cyberattack serves as a stark reminder of the growing threat posed by hackers and the critical importance of robust cybersecurity measures.

As more and more businesses rely on interconnected digital systems, the potential for widespread disruption from a single attack continues to rise.

For the automotive industry, the incident underscores the urgent need for dealerships to invest in multilayered security strategies and incident response plans to mitigate the risks posed by increasingly sophisticated cyber threats.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free