Dealers ‘Quickly Coming Online’ Following CDK Cyberattack

Jamie Tarabay, Bloomberg News

Vehicles for sale at an AutoNation Honda dealership in Fremont, California, US, on Monday, June 24, 2024. The hack that's disrupted business at thousands of car dealerships in North America is now in the process of getting resolved, the targeted software provider CDK Global said. Photographer: David Paul Morris/Bloomberg , Bloomberg

(Bloomberg) -- Dealerships that rely on software from CDK Global are coming back online and services are being restored after a devastating cyberattack caused widespread disruption.

Unit 42, the threat intelligence arm of Palo Alto Networks Inc., is “working hand in hand with CDK and their partners to restore operations,” said Sam Rubin, vice president and global head of operations for the cybersecurity company. “Dealerships are quickly coming online and services are being restored.”

CDK confirmed that it’s working with Unit 42 to restore operations. “We are continuing our phased approach to the restoration process,” the company said in a statement. CDK has “successfully brought two small groups of dealers and one large publicly traded dealer group” back online on its dealer management system, or DMS, it said.

CDK also is working to bring additional applications, such as its customer relationship management and service solutions, back online. “In the meantime, we have created a Dealer Resource Center with commonly used documents and forms to support their sales and service efforts,” the company said.

The cyberattack began on June 19, creating havoc at some of the 15,000 dealers that rely on CDK’s management software. A hacking gang called BlackSuit has been blamed for the ransomware attack and has demanded tens of millions of dollars in ransom, Bloomberg News reported.

CDK previously told dealers the outages could persist for some dealers until June 30.

“We understand and share the urgency for our customers to get back to business as usual, and we will continue providing updates as more information is available,” the company said Friday.

(Updates with CDK statement in third paragraph.)