The CDK outage: when the software every dealer runs went dark

About this series

The June 2024 disruption

On June 19, 2024, the automotive industry in North America faced a sudden halt. CDK Global, a provider of dealer-management software used by nearly 15,000 dealerships, was hit by a Ransomware (show definition) attack. The attackers, later identified as the BlackSuit group, encrypted the systems that dealerships use for almost every daily task. For nearly two weeks, showroom floors went quiet and service bays struggled to process work orders.

The impact was not limited to just one brand or city. Because so many dealerships relied on the same cloud-based platform, the failure was systemic. Dealerships found themselves unable to access customer records, finalize financing, or even track inventory. This incident serves as a primary example of how vendor concentration can turn a single company's security failure into a regional economic event.

The risk of concentration

Many industries rely on a dominant software provider. In automotive retail, CDK Global and a few competitors handle the vast majority of operations. While using a specialized tool is efficient, it creates a single point of failure. If that tool goes dark, the entire industry feels the impact simultaneously. Small and mid-sized businesses often feel this most acutely because they lack the deep reserves of larger corporate groups to weather long periods of lost revenue.

Concentration risk is often invisible until it is too late. Businesses choose vendors based on features and price, but rarely evaluate what happens if that vendor disappears for a month. The 2024 outage proved that even large, well-funded software providers are vulnerable. A business that puts all its operational eggs in one basket must have a plan for when that basket breaks.

When the screens go dark: manual workarounds

When the CDK systems failed, many dealership employees had to revert to methods not seen in decades. Staff used paper ledgers, whiteboards, and physical spreadsheets to track car sales and service appointments. Some dealerships even reported using handwritten bills of sale to keep the doors open. While these efforts were heroic, they were also slow and prone to error.

A key lesson from 2024 is that a Incident response plan (show definition) must include a 'paper mode.' Most modern businesses have forgotten how to operate without their primary software. During the restoration phase, dealerships faced repeated disruptions as systems were brought back online and then taken down again for security checks. Having a written guide for manual workarounds ensures that staff know exactly how to handle a transaction when the internet or the vendor is unavailable.

• Identify the critical systems that would stop your business if they went offline
• Create physical or offline templates for your most frequent transactions
• Designate a secure way to collect customer data when the main database is down
• Plan for how to sync manual records back into the digital system once it returns

Calculating the cost of downtime

The financial toll of the CDK outage was massive. Reports estimated that dealerships lost billions in collective revenue during the two-week shutdown. Beyond the lost sales, there were costs associated with delayed service revenue and the administrative burden of cleaning up two weeks of manual records. For a mid-sized business, a similar two-week outage could be fatal without adequate reserves or insurance.

Small businesses should perform 'downtime math' to understand their exposure. This involves calculating the daily revenue lost if core systems fail, plus the cost of employee labor to catch up once systems return. This calculation helps justify investments in redundant systems or higher levels of cyber insurance coverage. It also helps in negotiating Service Level Agreements (SLAs) with vendors, ensuring that recovery times are clearly defined and backed by financial penalties.

Resilience beyond the vendor

Vendor transparency is a critical part of recovery. During the 2024 event, many dealerships felt left in the dark regarding when their systems would return. This lack of communication hindered their ability to make decisions about staffing and customer outreach. When selecting a vendor today, businesses should ask about the provider's communication plan during a crisis. A vendor that cannot promise clear, frequent updates is a higher risk than one that can.

Finally, businesses must realize that they cannot outsource their responsibility for security. Even if a vendor is at fault, the business owns the relationship with the customer. The dealerships that fared best in 2024 were those that communicated early and often with their clients, explaining the situation and offering alternative ways to get service. Technology will fail, but a resilient business structure can survive the failure.