CDK Global Cyber Attack: Major Disruption in the Automotive Industry 

I am so sorry

SAME HERE BRO , My hand is HURTING .I never have used these hand writtens Repair orders so it was tough with a stream of customers with diagnostics 😭

Just got bitched at by a customer, pray for me

It sounds like you're managing under tough circumstances. Thanks for sharing your experience!

Figurring Out status updates when it’s a teammate’s client, and they forget, don’t know which advisor it is, fun!!!

It's very valuable to hear firsthand accounts like yours. Surely, the automotive industry has a long way to go when it comes to its IT infrastructure.

😁

I work for an MSP that handles multiple auto dealerships. Got lots of angry calls today. Nothing I could do as it's CDK's problem to fix!

😁

I can imagine this to be really tough for all employees. This highlights the importance of incident response planning for companies.

Im the parts manager for a bodshop at a dealership. Its hard enough to get parts in general but now this, end of the month too... We went to excel spreadsheets for parts inventory and to place SORs but the parts I do have I cant invoice or receive them in the bodyshops RO system cuz they arent invoice through CDK.

Very bad no one knows what to do. Pretty easy fix but have to know how. Oh wait, wrie it down. !

Oh no, that's really disappointing!

Yeah not a good situation at all

I’m hearing weeks bud

@@GiveMeTheRedPill yea, same, but maintaining optimism, or just naieve lol. The jobs have to get done, and mo ey has to be made

@@GiveMeTheRedPill I heard the same thing.....weeks.

Thanks for sharing your insight!

True!

Correct and they won't change until individuals start demanding better protections of their data. Being down is one thing, the data they steal is a whole other problem.

Trust me such an innocuous mundane tool that you pay no attention too can cause the most drama in your life. You can’t prepare for everything and how were dealerships supposed to prepare for hackers for a 3rd party web developer who’s main tools are used for checking people out through service for their cars or parts…?

😁

nissan Dallas parts here 😭💯

This CDK outage must be a real pain for parts departments everywhere. 😓

I hear you! 😓

💪

It must have been tough for you. Thank you for sharing your experience.

I can imagine how frustrating that must be for you. 😓

If we get that info back…

Smart move being cautious with the paperwork!

feel this

That sounds really frustrating!

Thanks for sharing your experience. I can only imagine how challenging that must be right now.

what mpi system are you using?

Thanks for sharing your experience. It's great that you at least have a backup plan with the MPI system.

Ouch

I'm sorry. We don't cover ransomware.

Sounds like Long Island is getting hit hard. A second attack suggests that the first wasn't probably handled well.

What a great timing! Glad for you.

Agreed, cybersecurity breaches can have a significant impact on customer trust.

If the system is still down by Monday then nobody is getting paid. Just IOUs. How many sales people are living paycheck to paycheck? This is a disaster 😭

That's a massive worry. Hopefully, payroll systems gets prioritized.

Yep… came in on day off to make a deal only to find out cdk was down! 🤬

That sounds really overwhelming. 😓

😣

I can imagine how difficult it is. How are things going now?

Wow 💯🤦🏻‍♀️

Bro same working at vw can’t even do warranty

I'm sorry to hear that-it must be incredibly challenging right now. Thanks for sharing your experience here.

Wow, crazy timing indeed!

Thanks for your comment! How are things going now?

@@XactCyber we are still not using CDK

Sounds like a tough situation to manage.Yeah, it's affecting almost all dealers.

😁

Bingo. I totally agree. CDK too lax and not making investments to their ancient software and got caught with their pants down.

@petmitsu imagine how many "I.T. companies" are in the same boat?

Lol, but why would the dealership even pay? They are already paying cdk a lot for their services lol.

Wow, that sounds really frustrating. It must have been difficult to speak with customers with nothing to say.

If that's really the case, then that's definitely not ideal. Hopefully CDK gets things back up and running soon!

at my dealership i’m not sure about the advisors, but technicians are getting their average flat rate hours (based on prev 4 weeks) for this week.

Wow, that sounds challenging indeed! 😲Have things now improved?

@@XactCyber the situation hasn't improved, but our processes have. We've put Microsoft Excel to work big time in order to write up quotes, invoices, purchase orders, figure out pricing and all that. For now all of it is sort of placeholder for when the system comes back up, so while money is changing hands between us and our customers, none of it is being "accounted" for in the system, which means no financial reports for the end of the month or the quarter for shareholders. Inventory isn't being updated so we have to keep track of what we sell so we can reorder it manually etc etc The biggest thing that's going to happen because of this has to do with the financial reports and lack of automatic stock replenishment. No financial reports for the whole of CDK dealerships is huge for the overall economy because CDK represents 2.6% of US GDP. Right now we're at about 3% GDP growth according to economic dudes, which means when EoM and EoQ comes up, that growth will be largely wiped out by CDK. With lack of automatic replenishment, the warehouses aren't as busy as usual because fewer parts are moving which could result in layoffs or furloughs if this continues much longer, then it goes back to the manufacturers and you can see where that heads.

@@XactCyber the situation hasn't improved, but our processes have. We've been making spreadsheets with formulas and all that in order to create quotes, invoices, purchase orders and everything that CDK used to do for us in order to just keep customers happy, cars on the road, and the process moving. We've also been able to acquire bin locations for all our parts from the manufacturer based on our guaranteed inventory, so at least we know where our parts are. So it's still a little more work than before since there's no centralized program doing all of it for us in a seamless manner, but the work flow is better than when it started. The real problem is threefold now. First, the accounting and financial reporting end of the business is going to be totally bucked up for end of the month reports, so investors aren't going to be happy. Second, even from just a parts standpoint, let alone sales, this represents a massive disruption which will be felt through the whole economy. Third, when the system DOES come back up online, it'll be almost as disruptive for a few days as when it went down the first couple of days as dealerships catch up on entering all of the transactions, work orders, and invoices into the system. Now, I'm sure the accounting office has their own system figured out, but the fact of the matter is that CDK represents 2.6% of US GDP (according to CDK Global's website) and most of that has either been totally disrupted, or isn't going to be reported at all at the end of the month, which happens to be the end of the quarter. So expect an economic gut punch in the next few weeks regardless of whether or not CDK is fully back up and running. With warehouses not being as busy as they were (since parts departments don't have automatic replenishment orders now, we have to track what we sell and reorder it manually) they may experience some layoffs and furloughs, which will ripple out to the manufacturers who are also not selling as many cars. Fun!

I was just telling someone the other day to have a backup incase the system goes down. I guess it is a matter of time before internet or system goes down. Having a backup is always best. Not because of an if something happens, but a when it happens.

@@KellySeely-fk4pb exactly. It’s always a plus to have a backup plan. Also something I learned in the Corps 🤣 if plan A goes to shit, always have B C D E F in place.

@@jackwatson8966 You are exactly right! When I mention back up plans, it usually falls on deaf ears. Technology is great when it works. But what if it doesn't? Lots of our world hasn't "cross trained" in the unfortunate time when internet or computers are down. But in many cases those that want some paper are the bad guys.

Sounds like you're managing well! Has the situation already improved?

Probably the same experience with other MSPs handling auto dealerships. Thanks for sharing. With the scale of the attack, this might indeed take more than a week.

Appreciate you pointing this out.

It seems like that might be the case for many, based on these comments.

Interesting! Since Roadster is part of CDK, it makes sense some access would be limited. Thanks for sharing.

Gotta be a real test of patience!

Sounds like you're managing the situation as best as you can! Thanks for sharing your experience here.

It all depends but usually a combination of things has to happen. Initial access is typically achieved through phishing or social engineering these days.

Sounds like a nightmare! 🤯

Awesome! My nephew is a Honda tech. Had my car serviced today. No hiccups. I have all of my receipts to refer to for all service done the last two years. It was pretty busy in there today. Rolling with the punches. Pen and paper until things get rectified.

@@andrealouisabasile8529 we can't let these attacks stop us. We did have some upset customers over some delays as far as parts go.

What Honda ?

@@jesseespinoza4664 Honda west

Thanks for sharing your experience! Hoping for the best for you and your colleagues.

😁

Today was so crazy. i

Never again please​@@CURTBRAMBLE

Major props for keeping things moving manually! 😅

You don’t work here your the homeless that steals our WiFi from the building

I needed to use Google spread sheets for everything I handed out so I could remember what I had to bill out the past two days it’s been down, this shit sucks!!

Must be tough with sales down adding to the pressure.

We are manually writing Ros then parts are wrighting the part number and price on said Ros then when cdk is fix a new Ro will be written parts will be billed on it to correct inventor the customer will be billed at that point

most likely by using manual processes temporarily as shared by @jerryfitzpatrick4368

It's valuable to hear how this disruption is affecting everyone in different locations. Thanks for sharing your experience.

😓

It sounds like you're adapting well, which is impressive! 👍👍👍

Customers gotta chase the best deal! 😅 Hoping you get your systems back online soon though, to avoid more situations like this. Thanks for sharing!

You're absolutely right! This CDK situation is a domino effect.

talked to my largest parts auto group this morning their it guys came in and did a total disconnect from cdk

Sorry to hear you're facing trouble too. Have things already normalized?

@@XactCyber thanks my friend. We are still dead in the water right now!

@@joshuadelbasty1669 Thanks for the update, friend. Hang in there!!!

That's true. CDK is a major target because of its widespread use. Although I'd say with poor cybersecurity practices, others are as vulnerable to cyberattacks.

It's a messy situation for sure.

Thanks for sharing! Are you still down?

😓 I'm sorry to hear that, and thanks for sharing your experience.

Working at CDJR is rough on a regular day lately lmao

I'm sorry to hear that! It's definitely a challenging situation.

CDK or your Dad's dealership?

@@XactCyber my dads dealership:( don’t know if it’s related

OK, let him know about us if he needs help.

What? A dealership is being held ransome how?

@@Bullionista it would be great to know the details of your dad’s dealer situation. Especially if the CDK attack just opened a bunch of back doors to dealer’s nationwide. Please get the details and follow up - no dealer name required. Let us know if they are under a separate attack. Thx!

CDK had to shut down the phone systems yesterday too, including the account reps company cell phones. Not sure the status today. Last i heard there was 1 phone number for English, but good luck getting through

@@Grachi_504 that is for our poor IT guy to figure out. Bless his heart.

Yeah, CDK must be swamped with calls. It sounds like the gravity of the attack was downplayed in many dealerships, which resulted in worse scenarios.

@@XactCyber I agree. But you know the little people have to work through the issues. While the big guys in charge aren't in the thick of the issues or even in the locations.

😟 Thanks for sharing your experience. Hope all will be well soon.

Fair Warning , fellow Humans 🤖

You raise a good point about the future and potential vulnerabilities with AI. Thanks for sharing your thoughts!

@@XactCyber the irony : WE Created it . and could Well become Slaves // Victims of it .

😊

It's always good to have options. 😊

👊

Yikes

That's an interesting connection!

😊

Thanks for sharing. It seems like the downtime has been extended.

Feel u bro basically working for free

@@jalenherring7994 Demand to be paid straight time!

Techs like yourself are definitely on the front lines of the chaos.

Like Jaylin said we’re basically working for free. Some of the guys don’t even want to come in until it’s working.

Whew! 😓

Correct!

That would be unprecedented.

And most business don't have them

Thanks for pointing this out. We'll look into this.

Thanks for sharing your experience! Gotta admire the flexibility.

Thanks for sharing the update. Are you back online?

That sounds frustrating! Hoping you get your new Nissan soon! Thanks for sharing your experience with us.

😣

Yikes! They must be under intense pressure right now.

☺️

Thank you for your question! When a critical SaaS application goes down due to a cyber attack, it's essential for third parties to have a comprehensive plan in place. Here are some key strategies that can help ensure business continuity: Third-Party Risk Management: Incorporate in IR Plan: Make third-party risk management a major component of your Incident Response (IR) plan. This includes regularly assessing the security measures and protocols of your SaaS providers. Backup Procedures: Develop backup procedures that can be activated if a SaaS application becomes unavailable. These can include manual processes, redundant systems, or offline features that allow you to continue working without the primary system. Backup and Redundancy Solutions: Manual Processes: Document manual processes that can be used as a fallback if digital systems fail. Ensure employees are trained to execute these processes efficiently. Redundant Systems: Invest in redundant systems that can take over in case the primary SaaS application is compromised. This could be another SaaS provider or an on-premises solution. Offline Features: Ensure that critical features can operate offline. This might include local data storage and processing capabilities that sync once the main system is back online. Pre-Purchase Evaluation: Decision-Making and Evaluation: Evaluate the resilience and security of software providers before purchasing. As part of a good cybersecurity strategy, this includes understanding their disaster recovery plans, uptime guarantees, and security protocols. Vendor Reliability: Assess the vendor's history and ability to handle cyber incidents. Make sure they have robust incident response and recovery capabilities. Learning from the Automotive Industry: Avoiding Single Points of Failure: The automotive industry, and other sectors, must recognize the risks of relying too heavily on a single platform. Putting all your eggs in one basket can lead to significant operational disruptions. Diversification and Trust: Diversify your tech stack to mitigate risks. Relying on multiple platforms reduces the impact of any single point of failure. By focusing on these strategies, third parties can ensure they remain operational even if a critical SaaS application is compromised. The key is to integrate these considerations into your overall cybersecurity strategy and make informed decisions during the software procurement process.

😊

😂

Great work for keeping things moving. Thanks for sharing your experience!

No idea. I've seen systems down for weeks and months. This won't be a few days unless they pay the ransom quickly. Rarely do companies get back on their feet in less than 2 or 3 weeks. FBI could also step in and speed things up, but they're pretty busy. Seems they might run out of agents with all the attacks going on.

It seems like this disruption is affecting almost all major brands. Thanks for sharing this update.

It sure does have disadvantages. Thanks for sharing your thoughts!

😁

I'm also interested to know more about how the attack started. I'll definitely make another video once we learn more. But it's most likely through phishing or social engineering.

That's a surprising upside! Glad it's running smoothly for you.

😓

😉

Thanks for sharing your thoughts! Yes, clear communications is really important during disruptions like this.

I can imagine how overwhelming it must be right now. Thanks for sharing your experience.

Straight time!!!

🤔

I can imagine how challenging it must be for you today. 😓

@@XactCyber thank you! We are trying but from what I’m reading there is not a plan insight at the moment.