Key Takeaways From the CDK Global Cyber Attack
What Does CDK Do for Car Dealerships?
CDK Global offers comprehensive data and technology solutions tailored to automotive dealerships across the U.S. and Canada. Their software streamlines operations by managing various aspects of dealership functions, including car sales, service scheduling, oil changes, repairs, and more. From service advisors creating repair orders to mechanics tracking labor time and documenting repairs, CDK’s platform supports every step of the process. Additionally, dealership employees can efficiently clock in and out using CDK’s integrated software, enhancing operational efficiency.
CDK Global Ransomware Attack: June 2024 Incident and Its Aftermath
In June 2024, CDK Global, a leading provider of software solutions for automotive dealerships, experienced a significant ransomware attack that disrupted operations across North America. The CDK attack, which began on June 18, 2024, involved the BlackSuit ransomware group infiltrating CDK’s systems, leading to widespread service outages. This attack affected approximately 15,000 car dealerships in the U.S. and Canada, forcing many to revert to manual processes for nearly two weeks.
Compounding the situation, during the initial recovery efforts, CDK suffered a second cyber attack on June 19, 2024, further delaying system restoration. The attackers initially demanded a $10 million ransom, which escalated to over $50 million. CNN reports that on June 21, approximately 387 Bitcoin—then worth roughly $25 million—was sent to a cryptocurrency account controlled by hackers affiliated with the ransomware group BlackSuit, according to Chris Janczewski, head of global investigations at crypto-tracking firm TRM Labs.
The breach had significant financial implications, with estimates suggesting that dealerships collectively incurred losses exceeding $1 billion due to operational disruptions. Additionally, CDK faced multiple lawsuits from affected dealerships, alleging negligence in safeguarding their systems against such attacks. The Securities and Exchange Commission has been involved in addressing the repercussions of the ransomware attack, highlighting the regulatory role of the SEC in monitoring and addressing issues stemming from cybersecurity breaches.
By July 4, 2024, CDK announced that services had been fully restored for nearly all dealerships. The incident underscored the critical importance of robust cybersecurity measures and the potential widespread impact of cyber attacks on essential service providers.
CDK Global Cyber Attack Timeline – June & July 2024
Technical Analysis on How the CDK Global Cyber Attack Likely Happen?
While specific technical details about the vulnerabilities exploited in the June 2024 cyber attack on CDK Global have not been fully disclosed, we can piece together the general methods that were likely used by the attackers, based on common tactics employed in similar ransomware attacks.
- Initial Access: How Did the Hackers Get In?
It is suspected that the ransomware group BlackSuit used a combination of phishing and exploiting software vulnerabilities to gain access to CDK’s systems. Phishing, a method that targets employees with deceptive emails or messages designed to steal credentials or install malware, is a very common entry point for cybercriminals. Although CDK hasn’t confirmed this, phishing remains one of the most effective ways to compromise network security.
Additionally, CDK’s platform is accessed by dealerships via an always-on VPN, which allows local applications to connect with CDK’s systems. If vulnerabilities were present in the VPN or other components, this would have given attackers an opportunity to gain access to the network. The compromised sensitive data poses risks of identity theft and financial fraud, highlighting the severity of the situation.
- Lateral Movement: Expanding the Reach
Once inside the network, the attackers likely moved laterally across CDK’s systems. This means they used techniques like credential dumping, which involves stealing usernames and passwords stored in the system’s memory (RAM). With stolen credentials, attackers can gain access to additional systems, and exploit weak permissions to move deeper into the network. This technique helps them expand their reach and locate valuable data.
- Privilege Escalation: Gaining Full Control
To maximize the damage, the attackers likely escalated their privileges, gaining higher-level permissions to control critical systems. This could have been done by exploiting unpatched software vulnerabilities or leveraging administrative privileges to move freely through CDK’s infrastructure. With full control, the attackers could further compromise systems and prepare for the encryption of files.
- Payload Deployment: The Ransomware Strikes
The final stage of the attack was the deployment of the ransomware payload. Once the attackers had gained control of the systems and escalated their privileges, they encrypted key files and shut down CDK’s operations.
While the exact technical details remain unclear, these steps align with common tactics used in ransomware attacks, which have become increasingly sophisticated and damaging. CDK Global’s recovery efforts, including dealing with the ransom demand, ultimately helped restore services after significant disruption to the automotive industry.
What Business Can Learn from the CDK Global Cyber Attack
CDK underline the importance of preparing for the worst and implementing proactive strategies to protect against evolving cyber threats. At PSM Partners, we focus on delivering tailored IT solutions that ensure the security and continuity of your business operations. Here are several key lessons we’ve taken from the CDK breach that we apply to our own practices:
- The Necessity of Robust Cybersecurity Protocols
Cyber threats continue to increase across industries, with over 2,741 data breach incidents reported in the U.S. in 2024 alone. At PSM Partners, we emphasize the importance of investing in advanced security tools, training, and regular security audits. These audits help identify weaknesses, ensure regulatory compliance, and ensure continuous monitoring to detect potential vulnerabilities early. By implementing a strong patch management procedure, we ensure that your systems stay protected against known security flaws, reducing the risk of attacks.
- Developing Proactive Incident Response Plans
Having a well-defined incident response plan in place is critical. At PSM Partners, we help organizations prepare for incidents with comprehensive response and recovery strategies. A well-structured plan can significantly reduce downtime and operational disruption by detailing steps for immediate containment, clear communication channels with stakeholders, and a fast recovery process.
- Data Backup and Recovery
Data backup should be a standard part of any organization’s cybersecurity strategy. Regular, secure backups—stored separate from the primary network—allow businesses to quickly recover without falling prey to ransomware demands. At PSM Partners, we ensure that your backup strategy is both secure and reliable, minimizing the impact of any cyber attack.
- Third-Party Risk Management
Partnering with third-party vendors introduces additional risk, especially if their cybersecurity practices are not up to par. At PSM Partners, we emphasize the importance of thorough vendor assessments, ensuring that all third-party partners comply with stringent security standards and best practices. Before partnering with any vendor, we help clients assess their security protocols, certifications, and overall cybersecurity maturity to safeguard their interconnected systems.
- Employee Education and Training
A major attack vector is often human error, which is why continuous cybersecurity training is crucial. At PSM Partners, we prioritize training for all staff, not just IT professionals, to recognize phishing attempts and other social engineering tactics. Educating employees on data protection and best practices is one of the most effective ways to reduce the likelihood of a successful breach.
- Clear and Transparent Communication Channels
Effective communication is vital during a cyber incident. CDK’s lack of centralized updates on their breach led to confusion and frustration. PSM Partners helps businesses establish clear, transparent communication channels to provide timely updates to customers, stakeholders, and regulatory bodies. Regular updates help manage expectations, maintain trust, and ensure that everyone is informed of recovery efforts.
- Partner with a Trusted Cybersecurity Provider
As cyber threats evolve, partnering with an experienced cybersecurity provider ensures that you are always prepared. PSM Partners works with trusted experts who provide latest threat intelligence and risk management strategies, helping our clients stay ahead of potential risks. We ensure compliance with key regulations, while safeguarding sensitive data and systems from unauthorized access or leaks.
By collaborating with a cybersecurity partner like PSM Partners, you gain access to a wealth of resources and expertise. Our tailored cybersecurity solutions help protect your business, reduce risks, and keep you compliant—ensuring the safety and longevity of your operations.
Not sure where to start? We’ve got you covered! Get a free cybersecurity assessment and uncover potential vulnerabilities in your security—no cost, no obligation. Know where you stand and take the first step toward stronger protection today!
About the Author
Ryan Williams
Ryan Williams is the Practice Director of Professional Services at PSM Partners, where he leads a team of skilled cloud engineers in delivering innovative technology solutions. With 26 years of Microsoft technology experience—including expertise in Azure, Security, and Microsoft 365—Ryan brings a strategic approach to cloud solutions and business partnerships.
Related Insights
Understanding the CDK Cyber Attack: What Happened and What Businesses Can Learn
Key Takeaways From the CDK Global Cyber Attack Massive DisruptionOn...
Read More
Cloud Engineer vs. Software Engineer: Understanding the Differences
In today’s rapidly evolving technology landscape, both cloud and software...
Read More
Cybersecurity Jobs to Hire in 2025: Building a Strong Team for the Future
The cybersecurity job market is evolving rapidly, driven by advancements...
Read More
What Users Can Expect After The NetDocuments, Worldox Acquisition
Efficient document management is the key to the success of...
Read More