Cyberattack shuts thousands of US car dealers
text size

Cyberattack shuts thousands of US car dealers

System widely used for everything from tracking sales to scheduling maintenance

Vehicles are seen outside a Ford dealership in Colma, California. (Photo: Bloomberg)
Vehicles are seen outside a Ford dealership in Colma, California. (Photo: Bloomberg)

Thousands of car dealerships across the United States ground to a halt during a normally busy holiday on Wednesday after a cyber incident at CDK Global, a major software provider for dealers.

The company “shut all systems down and executed extensive testing and consulted with external third-party experts”, Tony Macrito, a CDK spokesman, said in an email.

The company’s core product — a dealer management system — and its digital retailing solutions have been restored, and CDK is testing all other applications and will provide updates as it brings them back online, Macrito said.

Wednesday, June 19, commemorating the end of slavery in the US, is celebrated as the “Juneteenth” public holiday.

CDK’s systems, which many car dealerships rely on to conduct almost all of their normal business, first went down around 2am Eastern time, said Brad Holton, vice-president of Proton, a cybersecurity firm that serves dealers and the auto industry.

He said CDK provided little information on what caused the outage that effectively shuttered many dealerships. Some were unable to function at all and others were forced to resort to paper record-keeping for routine services like oil changes, Holton said.

A BMW dealership in New York City told customers that it was forced to halt all new business, including scheduling appointments or car servicing. When asked how long its operations may be disrupted, a customer care representative for the store responded, “I truly have no idea.”

Other dealerships also struggled to do business. “We can’t access customer records, can’t set certain appointments. We can’t even print a repair order,” said Claire Glassmire, a receptionist at Barbera’s Autoland in Philadelphia. Employees have been using workarounds all day, said Glassmire, adding that “all our hands are tied”.

Proton’s Holton said some CDK functions began to come back online on Wednesday afternoon, but others remained down and the restored services weren’t fully operational.

A spokesperson for Toyota Motor Corp said the issue had been resolved and there was almost no impact to the Japanese automaker’s dealer network. Subaru said no impact had been reported.

“Dealers are very committed to protecting their customer information,” said Mike Stanton, president and chief executive of the National Automobile Dealers Association, adding that they are “seeking information from CDK to determine the nature and scope of the cyber incident so they can respond appropriately”.

CDK provides dealerships with services including online appointment-scheduling, electronic-signature capabilities and messaging tools between divisions, according to its website.

Do you like the content of this article?