Cyberattack disrupts service at US auto dealerships for a second day

Auto retailers across the U.S. suffered a second major disruption in as many days due to another cyberattack at the software provider thousands of dealers rely on to run their stores.

CDK Global informed customers Thursday of the incident that occurred late the prior evening. The company shut down most of its systems again, saying in a recorded update that it didn’t have an estimate for how long it would take to restore services.

“In partnership with third-party experts, we are assessing the impact and providing regular updates to our customers,” said Lisa Finney, a spokesperson for CDK. “We remain vigilant in our efforts to reinstate our services and get our dealers back to business as usual as quickly as possible.”

Dealers reliant on CDK, including in Michigan, were unable to use its systems to complete transactions, access customer records, schedule appointments or handle car-repair orders. The company serves almost 15,000 dealerships, supporting front-office salespeople, back-office support staff and parts-and-service shops.

“Our Michigan dealers are certainly impacted, as are dealers across the country,” James Fackler, executive vice president of the Michigan Automobile Dealers Association, said in a statement Thursday. He also said the group “received a second notice this morning that the issue is still being investigated.”

Todd Szott, president of the Detroit Auto Dealers Association and dealer partner at Szott Auto Group, said while his stores have been affected, “we have other systems that we’re able to sell cars with and service.”

The CDK dealer management system is how dealers create repair orders, receipts, checks and general dealership paperwork. Dealerships are still able to sell and service vehicles, but the process is more manual now.

“We’re gonna have to end up doing a lot of that stuff outside the system during the time that this is shut down,” said Szott, whose business operates five dealerships and three collision shops in Oakland County.

Dealers now have to take registration paperwork to the Secretary of State branch offices instead of uploading and sending over virtually.

“They’re going to probably start seeing some more dealers walking in the door,” Szott said.

Cheri Hardmon, a spokesperson for the Michigan Secretary of State’s Office, said the agency has “not currently” seen more dealerships walking in registration documents but is “making sure that our branches and our customer service are aware of this current situation so that they know how to manage it.”

Ford Motor Co. in a statement sent by spokesperson Richard Binhammer, said dealers still are able to assist customers.

“Although there is an industry-wide system outage for some dealers who use CDK, Ford and Lincoln customers are able to receive sales and service support due to alternative processes available to our dealers,” he said.

Kevin Farrish, president of a Chrysler, Dodge, Jeep and Ram dealership in Virginia, said the CDK shutdown has affected every department, and meant lots of extra manual work for his employees. It has been challenging to keep track of parts being sold and ordered. And the outage took down a related system where the dealership receives sales leads, which he said is likely frustrating to potential customers who aren’t getting a response to inquiries.

“We’re trying not to let it affect business, but it naturally is going to affect business,” Farrish said Thursday, adding he is hoping the system is back up within the next day or two.

Greg Thornton, the general manager of a dealership group in Frederick, Maryland, said his stores’ CDK customer-relations software had been down since early Wednesday morning.

“I can only assume that CDK is working all hands on deck to resolve this,” said Thornton, whose group includes Audi and Volvo stores. “We’ve had no conversations with them in person or over the phone.”

Sam Pack’s Five Star Chevrolet outside Dallas sold four vehicles on Wednesday despite the initial outage but has had to adapt, such as by handling some tasks on paper until service is restored, said Alan Brown, the store’s general manager. While sales staff are able to submit approvals to lenders, the outage has blocked other elements of a transaction, such as obtaining titles.

“We’re still doing business,” Brown said. “It’s just not our normal flow.”

A BMW store in Manhattan told customers Wednesday that it was forced to halt all new business, including scheduling appointments or car servicing. When asked how long its operations may be disrupted, a customer care representative for the store responded, “I truly have no idea.”

Other dealerships also struggled to do business. “We can’t access customer records, can’t set certain appointments. We can’t even print a repair order,” Claire Glassmire, a receptionist at Barbera’s Autoland in Philadelphia, said Wednesday. Employees have been using workarounds all day, said Glassmire, adding that “all our hands are tied.”

AutoNation Inc. led shares of publicly listed dealership groups lower Thursday, falling as much as 4.6% in intraday trading. Lithia Motors Inc., Group 1 Automotive Inc. and Sonic Automotive Inc. also slumped.

CDK’s systems, which many car dealerships rely on to conduct almost all of their normal business, first went down around 2 a.m. Wednesday, said Brad Holton, vice president of Proton, a cybersecurity firm that serves dealers and the auto industry.

A BMW store in Manhattan told customers that it was forced to halt all new business, including scheduling appointments or car servicing. When asked how long its operations may be disrupted, a customer care representative for the store responded, “I truly have no idea.”

Other dealerships also struggled to do business. “We can’t access customer records, can’t set certain appointments. We can’t even print a repair order,” Claire Glassmire, a receptionist at Barbera’s Autoland in Philadelphia, said Wednesday.

“Dealers are very committed to protecting their customer information,” said Mike Stanton, president and chief executive of the National Automobile Dealers Association, adding that they are “seeking information from CDK to determine the nature and scope of the cyber incident so they can respond appropriately.”

CDK provides dealerships with services including online appointment-scheduling, electronic-signature capabilities and messaging tools between divisions, according to its website.

Investment company Brookfield Business Partners agreed to buy CDK in an all-cash deal with an equity value of $6.4 billion in April 2022.

Detroit News Staff Writers Kalea Hall, Breana Noble and Luke Ramseth and Bloomberg’s Craig Trudell, Evan Gorelick, Kara Carlson, Jake Bleiberg, Lynn Doan and Cailley LaPara contributed.