Canadian dealers prepare for next ransomware attack in wake of CDK outage

In the wake of a devastating ransomware attack on software provider CDK Global Inc., the Canadian auto industry is bracing for more potential disruptions.

“This hit one company this time,” said Tim Reuss, president of the Canadian Automobile Dealers Association (CADA). “Nothing is to tell us it couldn’t happen to another company.”

The June 19 attack paralyzed the dealership management systems (DMS) of about 1,200 Canadian retailers, Reuss said. Operations were partially restored July 3.

The attack has galvanized efforts to improve cybersecurity.

“There’s a saying in industry that there are two types of companies — ones that have been hacked and ones that are going to be hacked,” said Michael Wyant, COO of Saskatoon’s Wyant Group, which has 19 dealerships in British Columbia, Alberta and Saskatchewan. “If dealerships haven’t already beefed up their security, they should.” 

The outage illustrated the need to not rely solely on one system to operate, said Huw Williams, CADA’s public affairs director.

“What’s important is this will remind dealerships to have redundancy and systems to deal with outages,” Williams said.

“We’ve heard incredible stories of dealerships staying open and finding innovative ways to make sure customers are served, which speaks to the entrepreneurial nature of dealers.”

CDK Global sells a cloudbased DMS that can run everything from accounting, sales tracking and parts sales, to customer-retention and lead-tracking systems.

‘YOU HAVE TO GET BETTER’

Steve Chipman, president of Winnipeg’s Birchwood Automotive Group, said steps dealers are taking to improve cybersecurity include moving to 15-digit passwords from eight digits and changing them at least every three months.

“Anytime you’re challenged like this, you have to get better,” Chipman said.

Of Birchwood’s 23 stores in Manitoba, Saskatchewan and North Dakota, 19 were affected by the CDK outage.

The fallout might only be beginning for CDK Global. U.S. competitor Tekion Corp., which is expanding into Canada, attributes a recent runup in dealer inquiries to the CDK outage.

“Our dealer sign-up momentum was strong before the CDK cyber incident, and it has gotten stronger since with a lot more business signed,” said Tekion CEO Jay Vijayan, who, for competitive reasons, declined to provide specifics.

CDK responded to Automotive News Canada’s request for comment, pointing to a July 22 story by sibling publication Automotive News in which CEO Brian MacDonald said that customer connections were restored and that CDK was continuing to investigate the source of the breach. CDK did not confirm media reports suggesting it had paid a US $25 million (Cdn $33 million) ransom to resolve the outage.

Brent Walker, managing partner at Calgary’s Marlborough Ford, said CDK restored partial functionality at his store July 3 and full operations a week later. It “took about a week and tons of overtime to get caught up,” he said.

CDK Global waived Walker’s fees for June, and he’s satisfied with that compensation. 

“It definitely cost us more in lost revenue,” he said, “but at this point, we just want to move on.”

It’s hard to estimate the impact on sales, he said. “Say we lost 10 deals at an average $6,000 gross front and back. [It] could be $60,000. [We] probably lost about $15,000 to $20,000 in service/parts gross on where we projected.”

SOME REGIONS DID OK

In its June sales analysis, DesRosiers Automotive Consultants said the CDK outage “appears to have carried a clear sales impact, and one with regional implications.”

DesRosiers said June sales were similar to those in June 2023. But in British Columbia, sales fell 7.9 per cent, Alberta dropped 3.2 per cent, and Ontario declined 1.1 per cent.

In Manitoba, however, sales rose 15.7 per cent, “well ahead of the overall June market,” DesRosierssaid.Quebec sales rose 5.7 per cent and in Newfoundland climbed 18.1 per cent.

“The CDK outage appears to have impacted Canadian dealers in a noticeable way for June, and this impact was evidently far from evenly spread across the country,” DesRosiers Managing Partner Andrew King said in a news release.

Williams said CADA is working with CDK and the federal government’s privacy commissioner to protect dealers and their customers from ramifications of the breach and stressing to CDK that the onus for reporting privacy breaches to Ottawa should fall solely on CDK.

“The important thing is that dealer suppliers get the message that we need to have security we can count on and protect customers and dealers,” he said.