Cyberattack Forces U.S. Car Dealerships to Revert to Pen and Paper

A cyberattack has compelled car dealerships across the U.S. to revert to using pen and paper for vehicle sales, a disruption anticipated to persist for several days. CDK Global, the company responsible for the affected software, informed dealerships that it experienced two cyber incidents on Wednesday and proactively disabled its software to safeguard customer data. A CDK spokesperson declined to provide additional details.

Impact on Dealership Operations

Approximately 15,000 dealerships rely on CDK’s software for managing sales, payroll, and general office tasks. The system has been offline since the incidents, hampering dealership operations for sales and repairs. Analysts at JPMorgan Chase noted on Friday that many dealerships are handling the outage by manually recording car sales and terms. They suggested that dealerships might lose revenue on repairs as customers seek service from non-CDK-using dealerships for quicker fixes.

CDK’s software outage disrupts dealership operations, causing sales and repair losses as customers seek alternatives, according to WSJ Print Subscription.

Financial Repercussions

Last year, the U.S. auto dealership sector reached a value of $1.2 trillion. The National Automobile Dealers Association, representing over 16,000 dealerships, reported this figure. On Friday, the association said its members are contacting CDK about “the nature and extent of the cyber incident to respond appropriately.” Over the past few days, shares of auto dealers have dropped. AutoNation fell over 4% in the last two days, and companies like Lithia Motors and Sonic Automotive also saw declines.

---

---

Cybersecurity Vulnerabilities Highlighted

A key supplier’s breach underscores frequent vulnerabilities in corporate cybersecurity measures. Companies remain at risk from compromised suppliers. Hackers often exploit supplier entry points to target multiple companies. Last year’s MoveIt cyberattack from Progress Software affected thousands of businesses.

Historical Context and Recent Developments

High-profile supply chain hacks on widely utilized service providers demonstrate the severe repercussions on their customers. For instance, a ransomware attack in February on UnitedHealth Group’s Change Healthcare unit, which operates the largest U.S. clearinghouse for health-insurance billing, halted revenue for medical providers and led some to furlough staff. CDK was acquired by investment firm Brookfield Business Partners in 2022 in an $8.3 billion deal, including debt.

Warnings and Precautions

In a 2023 report, CDK surveyed dealers about the threat of cyberattack, emphasizing the importance of protecting against such threats. “Cybercriminals continue to target dealerships with ever-evolving tactics to steal user and client data, ranging from password theft to sophisticated phishing schemes,” the report stated. On Friday, CDK warned that individuals were contacting dealerships and impersonating CDK employees to gain access to their systems. “CDK associates will not and have not been soliciting access or passwords,” the message stated. “Any such request should be immediately regarded as suspicious.”

---

Unlock 77% off premium journalism with the Washington Post and NYT Gift Subscription. Enjoy extensive coverage and top-quality reporting on politics, science, and more. Invest in informed citizenship and stay updated anytime, anywhere. Subscribe now for unparalleled insight!