If you’re hoping to purchase a new car in North America this week, you may be in for a bit longer of a process after back-to-back cyberattacks hit CDK Global, which provides software for thousands of auto dealerships, forcing many to look at alternative methods.
The company said the attacks led to an outage that is still impacting its operations, and by relation, the work of dealers across Canada and the U.S.
Tim Reuss, president and CEO of the Canadian Automobile Dealers Association, told Global News in an interview that the outage by CDK had impacted “hundreds” of dealerships in Canada.
“We’re talking hundreds of dealerships across Canada and they have all brands under the sun,” he said.
Stellantis, which has dealerships in Canada and the U.S., told Global News many of its dealerships have switched to manual processes to help customers — including with pen and paper.
“The CDK situation continues to evolve. Our dealerships remain open at this time, and we continue to monitor it closely with CDK as they work to resolve this issue,” a spokesperson for Stellantis said in an email.
Group 1 Automotive, which owns and operates 202 auto dealerships, 264 franchises and 32 collision centres in the U.S. and U.K., said in a news release on Monday that its business applications and processes at its American operations were impacted.
It said that when the issue arose, it activated its cyber incident response procedures to protect and isolate its systems from CDK’s platform, and has been using “alternative processes” to conduct business until CDK’s systems are available again. It added dealerships in the U.K. don’t use CDK systems, so those have not been impacted.
What is CDK Global?
CDK is considered a major player in the auto sales industry and provides software to dealers which help with operations like facilitating vehicle sales, as well as financing, insurance and repairs.
More than 15,000 retail locations are serviced by CDK Global in North America.
Where does restoration stand?
Restoration is still slow-going, with the company having shut down all of its systems “proactively” when the attacks occurred.
In an update over the weekend, spokesperson Lisa Finney told the Associated Press it had begun the restoration process. However, she said consumers should anticipate the process to take several days and the company would engage with customers to provide alternative ways to conduct business.
She also said it is working with third-party experts to investigate the incident and had notified law enforcement.
Dealerships have been warned, however, to be cautious of any attempted phishing as “bad actors” posing as CDK could try to obtain system access.
Global News has reached out to CDK Global for comment but has not yet received a response.
Are sales still happening?
Ford also confirmed to Global News on Monday that the CDK outage had impacted some of its dealers, but that sales operations continue.
Asbury Automotive Group in the U.S. said in a statement it too was affected by the attack, with sales, service and inventory functions impacted.
For some like Plaza Ford general manager Katie Walls Gugliota in Baltimore, working without the CDK systems has left paperwork to build. After the second cyberattack, she said the company decided to shut down business until systems are back up and running.
“This is a first for us, so this is uncharted territory,” she told CBS News’ Baltimore last Thursday. “We are completely dead in the water.”
It’s not yet known how long the impact of the outage will last, with no date for full restoration. Yet some cybersecurity experts have cautioned that consumers connected to CDK should assume their data may have been breached and to monitor credit and be wary of phishing campaigns.
Reuss said it will be pressing CDK for more transparency and if any customer data was impacted from the cyberattacks.
He added, based on what the CADA and its members have received, restoration is likely to be a “matter of days,” yet he added that even once that is done, it would still take longer for dealerships affected.
“All of the things that they’re doing in other ways currently, pen and paper, other systems, et cetera, it then needs to be put back into their central systems and then reconciled with their reality,” he said. “So there’s going to be a bit of a hangover for this one for quite some time.”
— with files from The Associated Press and CBS News Baltimore