Cybercriminals paralyzed the car dealership software provider CDK Global with back-to-back ransomware attacks. The result has car dealerships reverting to paper and pens to work out many of their computerized functions. The first attack caused CDK to take its two data centers offline, and once it was recovering from the attack that impacted thousands of car dealerships across the US, the hackers struck again. The second attack occurred on June 19, again forcing CDK to shut down its systems.
GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE
What you need to know about the CDK cyberattack
The cyberattacks on CDK Global didn’t only impact the company but also its thousands of customers and regular folks who were planning to buy new automobiles.
CDK Global is a SaaS provider to clients in the auto industry. It provides car dealerships with software to handle operations like financing, inventory, back office, payroll, and more. CDK’s services are used by over 15,000 car dealerships across North America. The company also employs thousands of people.
Timeline of the attacks
Cybercriminals targeted CDK twice. The first attack occurred earlier this month, and while CDK Global didn’t reveal details, Bleeping Computer reported it was related to the company’s always-on VPN.
Car dealerships use a special kind of VPN connection that’s always on to connect to CDK’s data centers. This lets their dealership software, installed on their computers, access CDK’s platform. Since the CDK software has permission to update itself (like admin privileges) automatically, it makes sense why CDK recommended disconnecting from their data centers during the security incident.
CDK reported restoring some services on June 20 and told CyberGuy that its systems were again offline due to another cyberattack. “Late in the evening of June 19, we experienced an additional cyber incident and proactively shut down most of our systems. In partnership with third-party experts, we are assessing the impact and providing regular updates to our customers,” said Lisa Finney, Senior External Communications Manager at CDK Global.
“We remain vigilant in our efforts to reinstate our services and get our dealers back to business as usual as quickly as possible,” Finney added.
CDK Global announced on June 24 that the breach was, in fact, a ransomware attack, meaning the company’s systems won’t be back online until it pays the hackers a ransom. CDK’s software remains down as of this writing, and Reuters reported that it won’t be back online until the end of June. Bloomberg reported that a hacking group called BlackSuit is behind the cyberattack on CDK Global, demanding an extortion fee of tens of millions of dollars.
PHARMA GIANT’S DATA BREACH EXPOSES PATIENTS’ SENSITIVE INFORMATION
How are dealerships responding?
Car dealerships across the US are feeling the pinch from the CDK cyberattack. But some dealerships are showing their resourcefulness. Employees are taking to social media, like Reddit, to share how they’re keeping things going with spreadsheets and sticky notes. This allows them to handle smaller sales and repairs, but for now, bigger transactions are on hold.
Big names like Honda, Toyota, and Hyundai are closely monitoring the situation to see how badly the outage is hurting dealerships. Honda even went further, telling affected dealerships to use alternative tools and processes to keep business running smoothly while CDK gets its systems back online.
MASSIVE FREE VPN DATA BREACH EXPOSES 360 MILLION RECORDS
How does the CDK cyberattack impact you?
Car dealerships rely on CDK’s software to manage various aspects of their operations, including financing and inventory management. When these systems are down, it can delay the process of purchasing a car, affecting those who are in the market for a new vehicle.
If you’re seeking services from dealerships, such as maintenance or repairs, you may experience delays or disruptions because the dealership’s management systems are offline. CDK’s software also helps dealerships manage financing and leasing agreements. The cyberattack has disrupted these processes, leading to delays in securing loans or leases for customers.
TICKETMASTER DATA BREACH EXPOSES 560 MILLION CUSTOMERS’ DATA SAYS IT GROUP
Cybersecurity lessons you can learn from the CDK global attack
The CDK Global cyberattack serves as a stark reminder of the vulnerabilities inherent in our digital world and the far-reaching consequences of such breaches. This incident underscores several key security considerations you should take into account:
1) Ransomware awareness and prevention
The revelation that the attack involved ransomware highlights the ongoing threat posed by this type of malware. It’s a reminder that you need to be vigilant about the security of your personal devices. Here are some steps you can take:
Regular Backups: Ensure that you regularly back up important data to an external hard drive or a secure cloud service. This can help you recover your data without paying a ransom if your device is compromised.
Update software: Keep your operating system, antivirus software, and all applications up to date to protect against known vulnerabilities.
Email Caution: Be wary of unsolicited emails, especially those with attachments or links. Phishing emails are a common method for delivering ransomware.
2) Strong authentication and access controls
While the CDK attack involved always-on VPN connections, the principle of strong authentication applies to you as well. Protect your accounts with:
Two-factor authentication (2FA): Enable 2FA on all accounts that offer it. This adds an extra layer of security beyond just a password.
Unique Passwords: Use unique, complex passwords for different accounts. Consider using a password manager to keep track of them.
3) Incident response and personal data protection
The prolonged outage and its impact on dealership operations underscore the need for you to have your own incident response plan:
Know your recovery steps: Familiarize yourself with the steps to take if your device is compromised, such as disconnecting from the internet, running antivirus scans, and restoring from backups.
Protect personal information: Be cautious about sharing personal information online. Use privacy settings on social media and be mindful of the data you share with various services.
4) Regular security audits
Just as businesses need to assess their security regularly, you should also:
Review account activity: Regularly check your bank and credit card statements for any unauthorized transactions.
Security settings: Periodically review and update the security settings on your devices and online accounts.
By taking these proactive steps, you can significantly reduce your risk of falling victim to cyberattacks. The CDK Global incident serves as a powerful reminder that cybersecurity is not just a concern for businesses but for you and everyone in our increasingly digital world.
Kurt’s key takeaways
When a company of CDK’s scale is affected by a ransomware attack, it disrupts the whole market—something we are witnessing right now. Many dealerships in the US use CDK Global’s software, meaning their business is paralyzed unless they can find another alternative. The company should work on tightening its security systems and hurry to deal with cyber criminals to minimize the losses suffered by dealerships.
What role should government and regulatory bodies play in supporting businesses affected by ransomware attacks? Let us know in the comments below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2024 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.
1 comment