Car dealerships were hobbled by outages for several days after cyberattacks on software vendors

NEW YORK – Auto dealerships across North America faced major disruptions this week.

CDK Global, a company that provides software to thousands of auto dealers in the United States and Canada, was hit by successive cyberattacks on Wednesday. This led to a power outage that continued to impact many of their operations on Friday.

For potential car buyers, that could mean delays at dealerships or handwritten car orders, with no immediate end in sight. Here's what you need to know.

What is CDK Global?

CDK Global is a major player in the automobile sales industry. The company, based outside Chicago in Hoffman Estates, Illinois, provides software technology to dealers that helps with day-to-day operations — such as facilitating vehicle sales, financing, insurance and repairs.

CDK serves more than 15,000 retail locations across North America, according to the company. It was not immediately clear whether all of these sites were affected by the cyber attacks that occurred this week.

What happened this week?

CDK is “actively investigating a cyber incident” and the company has shut down all of its systems out of an abundance of caution, CDK spokeswoman Lisa Feeney said Wednesday.

CDK “carried out extensive testing,” consulted outside experts, and had its core DMS and digital retail solutions restored by the afternoon, Feeney said in a prepared statement.

CDK experienced another “cyber incident” on Wednesday evening, Finney said in an update the next day. “We remain vigilant in our efforts to restore our services and get our agents back to business as usual as quickly as possible,” she said.

When that will be is still unknown. As of Friday morning, a recorded message from CDK on the hotline detailing the updates to its customers said: “We do not have an estimated time frame for resolution – therefore our reseller systems will be unavailable, likely for several days.” She added that customer service support channels also remain unavailable.

The letter added that the company was aware of “bad actors” posing as CDK members or affiliates to try to gain access to the system by contacting customers. She urged employers to be vigilant against any phishing attempt.

Are affected dealers still selling cars?

Several major auto companies — including Stellantis, Ford and BMW — confirmed to The Associated Press on Friday that the CDK outage affected some of their dealers, but the sell-off is continuing.

In light of the ongoing situation, a Stellantis spokesperson said many agents have turned to manual processes for customer service. This involves typing commands manually.

A Ford spokesman said the power outage may cause “some delays and inconveniences at some dealers and some customers.” However, many Ford and Lincoln customers still obtain sales and service support through alternative methods used at dealerships.

With many details of cyberattacks still unknown, customer privacy is also top of mind – especially with not much known about what information may have been compromised this week.

In a statement sent to the AP on Friday, Mike Stanton, president and CEO of the National Automobile Dealers Association, said, “Dealers are very committed to protecting their customers' information and are actively seeking information from CDK to determine the nature and scope of the cyberattack.” incident so they can respond appropriately.”