US car dealerships stop services after cyber attack

(Bloomberg) — Thousands of auto dealerships were shut down during a normally busy holiday on Wednesday due to a cyber incident at CDK Global, a major U.S. dealership software provider.

Bloomberg’s Most Read

The company “shut down all systems and performed extensive testing and consulted with outside experts,” CDK spokesman Tony Macrito said in an email. The company’s core product — a dealer management system — and its digital retail solutions have been restored, and CDK is testing all other applications and will provide updates as it brings them back online, Macrito said.

CDK’s systems, which many auto dealerships rely on to conduct almost all of their normal business, went down for the first time around 2 a.m. Eastern time, said Brad Holton, vice president at Proton, a cybersecurity company that serves dealerships and the automobile industry.

He said CDK provided little information about what caused the outage that effectively closed many dealerships. Some were unable to function and others were forced to resort to keeping paper records for routine services such as oil changes, Holton said.

A BMW store in Manhattan told customers it was forced to stop all new business, including scheduling appointments or car maintenance. When asked how long its operations might be halted, a customer service representative at the store responded, “I really have no idea.”

Other dealerships also struggled to do business. “We can’t access customer records, we can’t make certain appointments. We can’t even print a repair order,” said Claire Glassmire, a receptionist at Barbera’s Autoland in Philadelphia. Officials have been using workarounds all day, Glassmire said, adding that “all of our hands are tied.”

Proton’s Holton said some CDK functions began coming back online on Wednesday afternoon, but others remained down and the restored services were not fully operational.

A Toyota Motor Corp. spokesman said. said that the problem was resolved and that there was almost no impact on the Japanese automaker’s dealership network. Subaru Corp. said no impacts were reported.

“Dealers are very committed to protecting their customers’ information,” said Mike Stanton, president and chief executive of the National Automobile Dealers Association, adding that they are “seeking information from CDK to determine the nature and scope of the cyber incident so that can respond appropriately.”

The story continues

CDK provides dealerships with services that include online appointment scheduling, e-signature capabilities and cross-divisional messaging tools, according to its website.

Investment firm Brookfield Business Partners agreed to buy CDK in an all-cash deal with an equity value of $6.4 billion in April 2022.

–With assistance from Henry Seltzer and Tsuyoshi Inajima.

(Updates with comments from Toyota, Subaru.)

Bloomberg Businessweek Most Read

©2024 Bloomberg LP