CDK restores DMS service to most; rebuilding trust comes next

CDK, of Austin, Texas, and Hoffman Estates, Ill., said July 2 it had restored core DMS access to most of the 15,000 North American dealerships affected by the June 19 ransomware event, two days ahead of the timeline it had outlined just the day before.

But as the remaining dealerships regained their DMS capabilities, far more work remained. Restoration efforts are continuing for other CDK programs and regular third-party plug-ins and integrations. As of July 3, resolving those issues remains a work in progress that could take several weeks.

CEO Brian MacDonald has defended CDK's response to the attacks and said in a June 28 open letter to dealership customers that the company is "heads-down and focused on bringing you back to business as usual."

An investigation into the attacks is continuing, but CDK — the DMS leader with roughly 50 percent of the market — hasn't yet publicly disclosed if dealership, automaker or customer data was at risk or stolen. A return to normal could take considerable time and CDK is likely going through a complex process to get there, cybersecurity experts told Automotive News.

“There is no such thing as typical” when it comes to cyberattacks, said Erik Nachbar, CEO of cybersecurity firm Helion Technologies.

CDK’s “system is large and I’m guessing complex. Their software is based on old technology. If, for example, the attackers exploited a vulnerability in some old software code, that could take days to track down, assess, patch, test and bring back online.”

The process can be painstaking, Nachbar said, and often requires third-party expertise — an element CDK utilized — to identify and assess where the attack is taking place.

About a third of businesses impacted by cyberattacks and data breaches take a month or more to recover and that number keeps rising, according to Adam Crowell, vice president of legal and corporate development at KPA, a provider of compliance software and services for more than 15,000 U.S. auto dealerships. He said CDK’s recovery is trending similarly.

“While the scale and impact of the CDK cyberincident has been disastrous, recovery from other cyberattacks have followed similar timelines,” Crowell said.

He said it is tough to evaluate CDK’s response because there are still many unknowns about the attack.

“Even if CDK is able to restore system access to dealers this week, a full recovery that includes restoring all data and transactions to a preattack steady state may take longer,” Crowell said.

Once affected dealerships are back online with their CDK DMS, they will have clearer pictures of their damages, and Crowell said they could likely solidify any insurance claims. He encouraged impacted dealerships to “continue to track any extra and out-of-the-ordinary costs associated with the attack, along with lost income.”

When it becomes known whether customer data was stolen, CDK said it will handle a Federal Trade Commission Safeguards Rule requirement for dealers, mandating they notify the agency no more than 30 days after discovering a security breach involving access to unencrypted information for at least 500 customers.

Beyond bringing its systems back online, CDK must rebuild trust in its DMS and security as its dealership customers resume their routines.

The company faces a growing number of lawsuits alleging it failed to protect customers and dealership employees, with the cyberattacks putting their personal information at risk. Its competitors — Cox Automotive/Dealertrack, Reynolds and Reynolds, and Tekion among them — are likely ready to take calls from disgruntled dealers who decide to switch.

Dealerships were frustrated and overwhelmed as they scrambled to maintain business as usual without their CDK system and related software. They largely succeeded in addressing the shutdown challenge by turning to pen and paper and temporary third-party software workarounds. Sales continued, but at a slower pace, dinging June tallies in the United States. As of July 4, Canadian June sales data wasn't fully available.

Slower sales related to the cybersecurity attacks also affected five of the six large publicly traded U.S. dealership groups.

Asbury Automotive Group, AutoNation, Group 1, Lithia Motors and Sonic Automotive are CDK customers, and they warned their upcoming second-quarter earnings reports would show a negative impact from the cyberattacks. Penske Automotive Group said it does not use CDK’s DMS at franchised dealerships in the U.S. or the U.K. but does for its Premier Truck Group.

Thousands of dealerships contracted with CDK also missed their June financial statement filings. Most automakers granted impacted dealerships an extension ranging from a few days to a couple of weeks.

Retailers, meanwhile, wasted no time trying to reset their operations after CDK restored their DMS service.

Todd Szott, dealer partner at Szott Auto Group in the Detroit area and president of the Detroit Auto Dealers Association, said his CDK Global DMS was back in operation at all five of his Michigan stores on the afternoon of July 2. His staff is entering all the transactions they did by pen and paper during the shutdown into the DMS and the process is going smoothly, he said.

Szott said he’s still waiting for CDK to restore other applications his stores use for customer relationship management, computerized vehicle registration and online service scheduling.

The CDK shutdown was “very inconvenient,” Szott said, but his staff was able to maintain operations and exceeded his group’s goal of selling 500 new and used vehicles in June. His stores sell Chrysler, Dodge, Jeep, Ram, Ford and Toyota vehicles.

Szott has been complying with the Safeguards Rule. As a result of the CDK shutdown, he accelerated his regular schedule to test his dealerships’ electronic systems to make sure they are secure while training his staff to prevent phishing.

“Things like that that we’ve already been doing, [we’re] just making sure we’re doing it now because there’s a lot of activity, particularly on the phishing side,” Szott said. “It’s going to take us a little bit, a week or two to get all these transactions in and get these integrations up before we’re totally back to normal, but we’re on that path.”

Although the staff at Beyer Auto Group of Falls Church, Va., did not receive notice, they arrived at the office July 1 to find their CDK DMS was back online, COO John Altman said. However, the group still couldn’t access its customer relationship management system or use its third-party integrations as usual.

The first day back online, the group with eight dealerships in Virginia was scrambling to make a plan to get all the deals and service orders from the outage into the system and accounted for.

“There is some exasperation,” Altman said. “I can see on [employees’] faces that they are just looking at this monumental task. But at least they know where they are at this point.”

Now that the staff’s anxiety about the indefinite outage is dissipating, the group hopes to be mostly back to normal after the July 4 holiday, he added.

Todd Edwards, co-owner of Edwards Auto Group, of Council Bluffs, Iowa, which has nine dealerships in Nebraska and Iowa, has shared updates along the way since the first attacks on June 19.

Edwards told sibling publication Automotive News via email that he’s glad they’re close to functioning normally again.

“We have one store online, with the others expected today,” Edwards said. “We are doing accounting first before we roll out normal operations to the stores.”

Over at Headquarter, the focus is on moving ahead as efficiently as possible.

Now that Headquarter’s DMS is back online, Serra said colleagues and employees are figuring out how to best input repair orders and invoices completed on paper during the crisis.

“We’re going to be doing a lot of work during the July 4 weekend,” Serra said in advance of the holiday.

Serra added she hoped CDK and the industry at large would learn from the cyberattacks, with a goal of reducing the likelihood of future incidents. One way might be for dealerships to diversify the kinds of software that handle DMS tasks rather than using a single provider, she said.

“This is a feature that we all need to be ready for, just like we prepare for hurricanes in Florida. We need to be ready for [another cyberevent] to happen,” Serra said. “We can’t allow them to cripple us.”

— Paige Hodder, Gail Kachadourian Howe, Dan Shine and Julie Walker contributed to this report.