Recently, CDK Global reported that it was the target of not one but two large-scale cyber attacks. In response, CDK Global took steps to protect its IT network as well as the sensitive information in its possession. However, by taking its systems offline, CDK Global left the 15,000+ car dealerships that use CDK software unable to process transactions, leading to a precipitous decrease in revenue. Worse yet, there is no clear indication as to when CDK Global’s operations will return to normal.
If you operate a car dealership or another business in the retail automotive industry, and your business was interrupted as a result of the CDK cyberattack, it is important to understand your rights. Software vendors often have a contractual duty to ensure that the products and services they offer are delivered consistently and as expected. And, although the CDK Global cyberattack was likely the product of hackers trying to gain access to the company’s IT network, it’s possible that CDK Global could have done more to prevent the incident. A CDK Global business interruption lawyer can help affected parties learn more about their rights and what they can do to pursue a claim for compensation based on the revenue lost due to the CDK Global cyberattack.
About the CDK Global Cyberattack
According to various statements from CDK Global as well as other third-party news sources, CDK became aware that its systems were breached on June 18, 2024. This prompted the company to shut down its data centers and IT systems. However, in doing so, CDK Global caused a major disruption in the business of the 15,000+ car dealerships that use CDK software.
On June 19, 2024, when CDK was in the process of bringing its systems back online, it was once again forced to shut down its systems due to another cybersecurity incident. This appears to have been a second incident. In fact, in subsequent notification, CDK explained, “We are sorry to inform you that we experienced an additional cyber incident late in the evening on June 19th.”
On June 21, 2024, CDK Global issued a statement indicating that the company planned to get its systems back up and running on June 21, 2024. However, one of the company’s customers reported receiving a letter indicating that CDK Global stated it would take at least a few more days to bring its systems back online.
Subsequently, CDK confirmed that the incident stemmed from a ransomware attack. Evidently, a group of hackers is demanding “tens of millions of dollars” to release the information obtained through the cyberattack.
The Impact of the CDK Global Data Breach on Auto Retailers
The CDK cyberattack has dramatically impacted auto retailers across the country in the following ways:
Operational Downtime: Retailers are unable to access necessary software to manage sales, inventory, and customer interactions, leading to a halt in vehicle sales.
Lost Revenue: The inability to sell cars results in direct financial losses.
Additional Expenses: Retailers may incur extra costs to mitigate the impact of the downtime, such as hiring IT specialists, implementing temporary solutions, or notifying customers about the issue.
Do Auto Retailers Have a Business Interruption Claim Against CDK Global for Lost Profits?
A business interruption claim refers to a request for financial compensation due to a disruption in business operations caused by an incident involving another party’s negligence. Specifically for auto retailers using CDK Global’s software, a business interruption claim might be based on the lost revenue that accrued during the period of downtime in the wake of the recent cybersecurity breach.
The fact that the cyberattack was not caused by CDK, while relevant, isn’t the end of the inquiry because courts have held that businesses should foresee and address certain risks, including cyber risks.
Those who were affected by the CDK outage should consider reaching out to a CDK business interruption attorney to learn more.
