money

CDK Global cyberattack timeline

CDK Global, a software company servicing 15,000 car dealerships, suffered a cyberattack last week and has been offline since. The company's outage highlights a growing threat to critical infrastructure: corporate greed and negligence. Until corporations and governments prioritize cybersecurity over profit, attacks will continue.

Published July 3, 2024 at 2:56pm by Mary Walrath-Holdridge

Car Dealership Software Company CDK Global Targeted by Cyberattack, Causing System Shutdown

CDK Global, a major software provider for car dealerships, suffered a cyberattack on June 19, leading to a multi-day shutdown of its systems. The attack impacted over 15,000 auto dealerships across North America, disrupting vehicle sales, financing, and repair services.

Timeline:

June 19

CDK Global falls victim to a cyberattack, prompting the company to shut down most of its systems as a precautionary measure.
Despite restoring some systems, a subsequent attack in the evening leads to another shutdown.

June 21

Bloomberg News reports that a group claiming to be Eastern European hackers demands a ransom of millions of dollars in connection with the hack. An insider suggests CDK planned to pay.
Multiple outlets later identify the group as "BlackSuit," a cybercriminal team with links to the Russian hacking group "RoyalLocker."

June 22

CDK initiates a restoration process, expected to take several days, according to spokesperson Lisa Finney.

June 24

CDK Global notifies clients that the shutdown will extend until the end of June, though a small test group of dealers is brought back online.

June 28

CDK gradually brings systems back online, restoring services to two small dealer groups and one large dealer group.

July 1

CDK announces its plan to restore services to all dealers by July 4, employing a phased approach, according to spokesperson Lisa Finney.

July 4

The deadline for all dealerships using CDK to be back online after the attack.

URLs:

CDK Global works with over 15,000 retail locations: https://www.cdkglobal.com/automotive
Bloomberg News report on ransom demand: https://www.bloomberg.com/news/articles/2024-06-21/cdk-hackers-want-millions-in-ransom-to-end-car-dealership-outage?embedded-checkout=true
Multiple outlets identify BlackSuit as the attacker: https://www.bloomberg.com/news/articles/2024-06-24/blacksuit-cybercrime-gang-blamed-in-major-cdk-ransomware-attack?sref=sBMxP0gT
Reuters article linking BlackSuit to RoyalLocker: https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/#:~:text=SAN%20FRANCISCO%2C%20June%2027%20(Reuters,%2Dthe%2Dscenes%20software%20suppliers.

Quote:

"We are continuing our phased approach to the restoration process and are rapidly bringing dealers live on the Dealer Management System (DMS). We anticipate all dealers' connections will be live by late Wednesday, July 3, or early morning Thursday, July 4," - CDK spokesperson Lisa Finney to USA TODAY.