CDK Global reportedly pays $25m cyber ransom which cost dealerships dear

US software house CDK Global is reported to have paid out a $25 million ransom to hackers following a devastating June 19 cyber attack which likely cost its US dealership clients $600m in direct losses.

CDK’s software supports nearly 15,000 dealerships in North America by managing vehicle acquisitions, sales, financing, insurance, repairs, and maintenance.

Keyloop, the UK's dominant DMS provider, is not part of CDK Global. CDK sold off its international business, which rebranded as Keyloop in 2021.

CDK initially described the incident as a “cyber incident” in media statements although reportedly referred to it as a “cyber ransom event” with clients.

According to CNN, around 387 bitcoins worth around $25m were transferred on June 21 to a cryptocurrency account controlled by hackers associated with a ransomware called BlackSuit, detected on the basis of tracked blockchain data that records cryptocurrency transactions.

Bloomberg had previously reported that an Eastern European crime gang had demanded a multimillion-dollar ransom and that the company intended to pay.

A week after the purported payment, CDK - which has yet to confirm it made any ransom payment - announced it was restoring its software platform.

The ransomware attack in mid-June disrupted thousands of dealerships using CDK's software with analysts at Anderson Economic Group estimating that direct losses to the dealerships impacted by the outage could have reached a collective $600m over the 10-day shutdown.

An industry source supplying similar products told AM: "I’ve worked in a business which had been the victim of a cyber attack and I would not wish the experience on anyone – the damage to reputation can be immense before you even start to consider the cost of lost business and catch up for CDK customers.

"It’s a wake up call for our industry - a view of ‘it won’t happen to us’ just isn’t acceptable any longer.

"If a business with the resources of CDK can be taken down, you have to worry about the proliferation of small suppliers in the retail ecosystem and how well protected they are from attack – especially where they are integrating into the DMS.

"It's very easy to leave a backdoor open to be exploited. Its potentially just one missed patch update and before you know it, these guys are in, stealing data and inserting rogue code to lock systems.

"I suspect the impact of this will be felt by CDK for many years to come."