Auto dealerships in Illinois and throughout the country are scrambling after Hoffman Estates-based software firm CDK Global was hit with cyberattacks this week.
Half of about 30,000 new car dealers in the U.S. use some form of CDK systems, said Mark Bilek, senior director of membership for the Chicago Automobile Trade Association, which represents new car dealerships.
The Chicago area has 380 new car dealers and nearly 200 of them are affected by the outage, he said.
CDK provides software services to about 15,000 auto dealers across the U.S. and Canada. The company was hit with at least two cyberattacks on Wednesday that led to a company shutdown.
As of Friday morning, a recorded message from CDK on a hotline detailing updates for its customers said, “We do not have an estimated time frame for resolution — and therefore our dealer systems will not be available, likely for several days.” Customer care support channels also remain unavailable, it said.
Auto sales are traditionally brisk during the summer. But the CDK shutdown affects dealers’ “ability to process transactions for new and used vehicles, sell parts and provide repair orders for service,” Bilek said.
Some dealerships are writing up transactions by hand or resurrecting older software systems as workarounds.
“No dealers are shut down. It’s business as usual, but maybe slower,” Bilek said. He advised customers to call ahead to dealerships to check what they are able to do.
Dealers are trying to run their business but operations have slowed and are more cumbersome.
“It puts a lot of stress on customers and employees,” said Scott Grove, director of operations at Max Madsen Mitsubishi in Aurora. Titling and issuing new license plates is a big challenge, he said.
CDK has not yet given details of the cyberattack. It’s unclear if the incident was a ransomware attack or a data breach and when systems will be back online, though the company warned that restoring systems could take several days.
“We hope it’s contained,” Grove said.
Bilek said, “CDK needs to be very careful about turning things on so it doesn’t happen again. It’s not going to be as simple as rebooting your computer.”
Separately, CDK’s 2023 cybersecurity report found that 17% of auto dealers experienced a cyberattack or incident in the past year.
CDK Global spun off from ADP Inc. in 2014 and is publicly listed on NASDAQ. It employs more than 7,000 people.
This is the first large-scale cyberattack on auto dealers’ software, according to Bilek.
But other industries, particularly health care, have faced cyberattacks in recent months.
In May, a ransomware attack forced hospital group Ascension’s computer systems offline and divert ambulances away from some of its emergency departments, including one in the Chicago area.
At least two other hospital systems in the Chicago area have been attacked this year. The University of Chicago Medical Center said it was victim of a hack that may have exposed patient data in late May. A January hack of Lurie Children’s Hospital took down its phone, email and computer system for six weeks.
Contributing: AP
