CDK Global ran most US car dealerships on one platform — ransomware took it all down

CDK Global runs the dealer-management system that most North American car dealerships depend on for sales, financing, service scheduling and parts inventory — a single shared platform behind roughly 15,000 dealer locations, including major groups like Lithia Motors, Group 1 Automotive, Penske and Sonic, and manufacturers such as BMW, Nissan and Honda. On June 18, 2024, the BlackSuit ransomware gang hit that platform. CDK shut down its own IT systems the next day to contain the intrusion, and while it was in the middle of recovery, attackers hit it a second time.

The demand started at $10 million and rose past $50 million as the outage dragged on. CDK indicated it intended to pay tens of millions of dollars, and reporting later put the actual payment at roughly $25 million — about 387 bitcoin sent to a BlackSuit-linked account on June 21. Even with payment, restoring service to every dealership took until July 4, more than two weeks after the first attack.

Because CDK's software was the operational backbone for so much of the industry at once, the outage did not stay contained to CDK's own infrastructure. Dealerships lost the ability to process sales, cut financing paperwork, log service appointments or track parts — many reverted to handwriting deals and using outside software as workarounds. Anderson Economic Group estimated direct losses to franchised dealers in the three weeks spanning June 19 to July 5 at $1.02 billion, a figure covering lost sales and labor rather than CDK's own costs.

The concentration that made CDK valuable to dealers — one platform running finance, sales and service together, adopted industry-wide because it was more efficient than fragmented systems — was exactly what turned one ransomware intrusion into an industry-wide outage. No single dealership had a fallback, because the fallback had been designed out of the business in favor of running everything through CDK.