CDK cyberattack expected to cost car dealers more than $1 billion, Michigan study says
The nation's car dealerships experienced losses of more than $1 billion as the result of a nationwide hacking and ransomware attack on their software and systems last month, according to a new estimate from East Lansing-based consulting firm Anderson Economic Group.
A cyberattack on Chicago-based dealership software provider CDK Global that began June 19 forced CDK to shut down most of its systems across the country for its dealership customers until July 5. It left about half of the nation's car dealerships struggling to operate, forcing some to return to the days of pen and paper. According to Bloomberg, the group that orchestrated the attack demanded tens of millions of dollars in ransom to end it.
The result of the attack led J.D. Power and GlobalData to forecast late last month that U.S. retail sales in June across all automakers will be about 5.4% lower than they were in June 2023.
Based on June sales results, Anderson Economic Group on Monday revised its June 28 estimate, which had predicted dealers would experience $944 million in losses. The group now estimates total direct losses to car dealers in the three calendar weeks of the cyberattack actually reached $1.02 billion.
Anderson Economic Group has estimated losses from major events such as the 2023 UAW targeted strike against the Detroit Three.
Some sales losses can be made up later, some not
The $1.02 billion in losses includes revenue from the nearly 56,200 new car sales that Anderson Economic Group estimated were lost in those three weeks. It also factors in lost earnings on parts and service, additional staffing and IT service costs, plus floor plan interest costs on inventory that could not be sold. The estimate does not include damages to consumers, reputational damages to dealers, litigation costs and multiple other categories of damages, said Patrick Anderson, CEO of the group.
"The revision is based on actual June auto sales and the actual duration of the outage, as well as corroborating information from investor disclosures from publicly traded auto dealer groups," Anderson wrote in an email to the Free Press.
Anderson said the 56,200 new auto sales losses it estimated are much less than the actual sales drop that occurred in June and those expected for the first week in July. That's because the group presumes that "the large majority of people that signed a contract or made a commitment to buy a new car will, in fact, buy that car or a similar one from the same dealer," Anderson said.
But some customers will go to another dealer or postpone indefinitely, he said, and that is where the new sales losses arise.
“This episode is a wake-up call for the auto industry, and a warning to all others,” Anderson said. "Businesses that rely upon automated systems and centralized software − which means nearly all businesses − are vulnerable to hacking of systems managed by outside providers, and the losses caused by an outage can escalate quickly.”
Contact Jamie L. LaReau: jlareau@freepress.com. Follow her on Twitter @jlareauan.
This article originally appeared on Detroit Free Press: CDK cyberattack to cost car dealerships over $1 billion, study shows