CDK hack upends US auto industry, sending dealers back to paper forms

By Kannaki Deka and Nora Eckert

(Reuters) -U.S. auto dealers grappled with a cyber attack-led ongoing software outage on Monday, with some reverting to manual paperwork as car industry technology provider CDK worked to restore systems used by more than 15,000 retail locations.

The outage impacting CDK's dealer management system that is used to complete deals, track store profitability and monitor employee compensation, has "significantly slowed down" the auto retail industry, said Cliff Steinhauer, an official at The National Cybersecurity Alliance.

A hacking group called BlackSuit is behind the cyberattack on CDK, according to an intelligence analyst at security firm Recorded Future.

CDK, which reported the outage last week, did not immediately confirm that BlackSuit was responsible for the cyberattack.

It said it had begun the restoration process and it will take several days to complete.

Market research firm Cox automotive said the impact of the attack could be far less than feared, and that most of the sales would likely bounce back in July.

However, some large auto dealers have flagged a hit to their operations.

AutoNation, a leading auto retailer in the United States, said the outage was disruptive and had adversely impacted its business, though its outlets remain open, continuing to sell, service, and buy vehicles.

Peer Lithia Motors said it had experienced disruptions in its CDK-hosted system in North America, and that the incident was likely to have a negative impact on its business operations till the systems are fully restored.

Jim Seavitt, owner of Village Ford dealership in Dearborn, Michigan, said the outage has so far not dampened sales, but it has made its delivery process more laborious.

The dealership sold nearly 100 cars during a large sale it put on last week, Seavitt said, but because CDK generates the paperwork needed to formally handover the car to the customer, those vehicles were in limbo.

Seavitt expects the vehicles to be transferred this week after his team developed other ways to complete the necessary paperwork. CDK has told him that services will likely be down until mid-week. "We don't want to see this thing drag on," Seavitt said.

AutoNation and peer Group 1 Automotive said they were using alternative processes such as manual paperwork to conduct their business. Both said they had taken precautionary steps to protect their data.

"The timing of the restoration of other impacted CDK applications remains unclear at this time," Group 1 said in a statement.

Asbury Automotive also flagged a hit from the outage, but could not "confirm the full scope, nature and impact of the incident, or whether any customer data was accessed".

Auto retailer Sonic Automotive last week said the CDK outage was likely to have a negative impact on its business operations until the systems were fully restored.

Bloomberg News reported on Friday that a group of hackers claiming responsibility for the attack on CDK's software systems had demanded millions of dollars in ransom to put an end to the hack.

Village Ford's Seavitt said he hopes CDK pays the ransom so dealers can resume business as usual.

"We note some potential risk to late-June (U.S. auto sales) volume from the reported CDK dealer disruptions," Citi analysts said in a note last week.

Total new vehicle retail sales in the United States reached 1.1 million units in June last year, according to data from industry consultants J.D. Power and GlobalData.

(Reporting by Kannaki Deka, Shivansh Tiwary, Zeba Siddiqui, Nora Eckert and Nathan Gomes, Additional reporting by Abhinav Parmar; Editing by Jan Harvey, Mohammed Safi Shamsi and Shinjini Ganguli)