Cyberattack cripples 15,000+ North American auto dealerships that use the CDK dealership management system

A massive cyberattack has crippled over 15,000 North American automobile dealerships that use the CDK dealership management system. The software-as-a-service system (SaaS) can manage all aspects of a dealership from quotes to service to sales. Affected dealerships are forced to use pen and paper or stop operating until CDK Global resolves the problem.

SaaS is a popular alternative to locally-installed software. Many users today can create presentations using Microsoft Office for the Web, send emails using Outlook, and even run Windows 365 online (read about Windows 365 in this book on Amazon). It requires remotely hosted services and Internet to be working properly, but can reduce IT costs by eliminating local IT personnel and server hardware. The CDK Global dealership management system handles common pre-sales, sales, service, parts, and customer management services for a dealership, replacing locally installed systems.

In 2023, there were 16,835 light-car dealerships in America, 3,430 dealerships in Canada, and about 3,000 in Mexico. The CDK cyberattack has taken down over 15,000 clients including all GM dealerships, or over 64% of all North America dealerships. Although hosted services can be better protected against attacks with a large, central IT security team that monitors and mitigates attacks 24/7/365, a single successful cyberattack can disrupt services for thousands, even millions of customers.

The cyberattack began on June 19th and was partially mitigated later that afternoon to allow partial operations. However, a second attack that evening took the CDK dealership management system down again. In the meantime, thousands of dealership employees stand idle, go on unpaid leave, or attempt to continue operations using pen and paper. CDK Global does not have a definitive timeline for restarting its system.