how it happened
- whoBlackSuitransomware group
- the gapdealer platformone system for 15,000 dealers
- the result~2 weeks downdealers back on paper
what everyone assumed
A dealership chooses a platform like CDK because consolidating sales and service and financing into one system is what good operations looks like. The trade-off is rarely named out loud: when one vendor runs everything, that vendor’s downtime is your downtime. Treating an outage as an inconvenience is reasonable right up until the outage is total and the system is the only place the work lives.
what happened
The exposure was built into the architecture long before the attack. CDK’s dealer management system sat at the centre of roughly 15,000 dealerships, the connective tissue for daily operations. On 18 June 2024 a cyberattack attributed in reporting to the BlackSuit ransomware group hit CDK, which took its systems offline to contain it. During the early recovery a second intrusion struck on 19 June, pushing restoration further out. For close to two weeks, dealerships that had moved their operations into one platform found there was no second platform to move them back to.
step by step
- about 15,000 dealerships run on one platformCDK's system is the connective tissue for their daily work.the assumption breaks here
- 18 June 2024a ransomware attack hits CDKSystems are taken offline to contain it.
- 19 June 2024a second intrusion during recoveryRestoration is pushed further out.
- about two weeks on manual processesReported ransom around $25 million; dealer losses estimated near $1 billion.
how it surfaced
The scale arrived in the totals. The outage stretched across roughly 15,000 dealerships and lasted about two weeks, with many stores running on manual processes the whole time. CNN reported that around 387 bitcoin, then worth roughly US$25 million, was sent to an account tied to the attackers. The collective cost to dealers was estimated at about US$1 billion by the Anderson Economic Group. The number that retired the assumption was the duration: an inconvenience does not last two weeks across an entire industry.
When one vendor runs the core of the business, the question is not whether they will have an outage.
It is whether the business can still operate during one, and for how long.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe vendor is hit by ransomware and is offline for two weeks.what it costs youYou take orders on paper and phones, lose sales every day, and cannot tell customers when it ends.
- or it goes like thisit happenedCode Spaces, 2014howBackups live where the attacker can delete them too.what leaveseverything, with nothing left to restorewho ends up with itthe business itself, which closes
- or it goes like thisit happenedMaze / Allied Universal, 2019howAttackers copy the data before they lock it.what leavesfiles your backups cannot take backwho ends up with itthe public, when it is leaked
sources
your turn
what you can do about it
this week
Ask what the business does on day three if your most central vendor is down for two weeks.
Your company depends on a handful of systems that, if they went dark this morning, would stop real work rather than slow it down. The one place to look this week is the honest version of your continuity plan for the most central of those vendors: if it were unreachable for two weeks, what does the business actually do on day three, and is that written down anywhere a stressed team could follow it. The dealerships that fared best in June 2024 were the ones that still remembered how to operate without the system that had quietly become the whole operation.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →