(Bloomberg) — A dealership in Phoenix is handwriting contracts on paper and evaluating creditworthiness with assumptions. An Alabama Jeep owner keeps calling to find out when a replacement part will be in stock. A family in New Jersey is awaiting news on when they will be able to take delivery of their new Audi.
Bloomberg’s Most Read
This is life for auto retailers and their customers in the US and Canada after CDK Global – a provider of software for nearly 15,000 dealerships – was besieged by debilitating cyberattacks. The impact spread on June 19, costing North American dealers a burst of business on a federal holiday. CDK warned Thursday that a second incident will likely keep its systems offline for several more days.
The attacks have had a crippling effect on an industry that surpassed $1.2 trillion in sales last year in the U.S. alone and is in the throes of a late-quarter sales push. CDK’s core product – a set of software tools known as a dealership management system, or DMS – underpins virtually every element of auto retailers’ daily business.
“It’s mass chaos right now,” Diana Lee, chief executive of Constellation, a social media agency that works with U.S. auto dealerships, told Bloomberg Television. “The dealer is required to run a DMS for sales, service, parts, for every feature – even stocking a vehicle, you can’t do that without the DMS system. So it’s a disaster.”
CDK has not said who or what entity is behind the intrusion, but it issued a warning to customers Thursday night saying that “bad actors” are contacting customers, trying to capitalize on the confusion. “We are aware that bad actors are contacting our customers, posing as CDK members or affiliates, trying to gain access to the system,” CDK said. “CDK associates are not contacting customers to gain access to their environments or systems. Please only respond to known CDK employees and communications.”
There are only a handful of DMS companies for dealers to choose from after decades of consolidation in this segment of the auto retail industry. As a result, thousands of stores rely heavily on CDK’s services to arrange financing and insurance, manage vehicle and parts inventories, and complete sales and repairs.
CDK parent Brookfield Business Partners LP had its worst trading day since October – plunging 5.7% on Thursday – and extended its decline on Friday. Shares of dealer groups AutoNation Inc., Group 1 Automotive Inc. and Sonic Automotive Inc.
Meanwhile, CDK competitor The Reynolds and Reynolds Co. said it is looking for things it can do “quickly” for affected dealerships. “Our industry is under attack,” said Christopher Walsh, the company’s president, in a statement posted on LinkedIn. “The impact of this goes far beyond CDK – it is hurting many dealers and consumers as we enter the height of summer.”
Representatives from General Motors, Ford, Volkswagen, Mercedes-Benz and BMW confirmed that some of their dealers use CDK and said they are working with those affected by the outage. Other automakers did not immediately respond to requests for comment.
For Joshua Adams, a Jeep owner in Millbrook, Alabama, the CDK outage comes at an inopportune time. He had previously gone weeks without his 2020 Renegade sport utility vehicle while waiting for a warranty claim to be resolved.
This week, he called his dealership to verify that the final part needed to repair his vehicle had arrived as expected. The service center wasn’t sure, saying it was impossible to know because of the hack.
“They can’t tell me where my share is or when it will arrive,” Adams said. “We are on air.” He expects the delay to cost several hundred dollars in additional expenses for a rental car he drives in the meantime.
In New Jersey, the Lanni family was excited about the delivery of a new Audi Q5. Daniel Lanni and his wife removed the child seats from their old vehicle so they were ready to go into the new SUV. But on June 19, the dealer called to say the store’s computer system was down and it was unclear when they could take delivery.
Lanni and his wife reinstalled car seats for their children – ages 3, 5 and 8 – and said they had not heard from the dealer until Thursday afternoon.
“The kids were really excited,” said Lanni, a 41-year-old commercial real estate agent. “They are upset and now regularly ask about it.”
Alex Padron, sales manager at a Nissan dealership in Phoenix, said business was “almost at a standstill” on Thursday. Everyone who has purchased a vehicle from the store since 2014 — when they started using CDK’s software — has data stored in the system, he said.
“It’s probably more than 50,000” customers, he said.
The dealership is now writing contracts on paper and finding new ways to close deals. He said finance department employees had to “guess” customers’ creditworthiness based on “whatever information they could gather.”
Since the attack began, the dealership has been able to process about half the transactions it normally can. Anything complicated – say, a purchase that involves a trade-in or unusual financing – simply can’t be done.
“For this store, I would like to do 10 full deals a day,” Padron said. “Five, six, seven would be good today.”
Why ransomware hacks mean your money or your network: QuickTake
–With assistance from Wilfried Eckl-Dorna, Monica Raymunt, Keith Naughton, Ed Ludlow and Paayal Zaveri.
(Updates with comments in the fourth, fifth and eighth paragraphs)
Bloomberg Businessweek Most Read
©2024 Bloomberg LP
