Car dealerships in North America revert to pens and paper after cyberattacks on software provider

NEW YORK (AP) — Car dealerships in North America continue to wrestle with major disruptions that started last week with cyberattacks on a software company used widely in the auto retail sales sector.

CDK Global, a company that provides software for thousands of auto dealers in the U.S. and Canada, was hit by back-to-back cyberattacks Wednesday. That led to an outage that has continued to impact operations.

For prospective car buyers, that may mean delays at dealerships or vehicle orders written up by hand, with no immediate end in sight.

On Monday, Group 1 Automotive Inc., a $4 billion automotive retailers, said that it continued to use “alternative processes” to sell cars to its customers.

Here is what you need to know.

What is CDK Global?

CDK Global is a major player in the auto sales industry. The company, based just outside of Chicago in Hoffman Estates, Illinois, provides software technology to dealers that helps with day-today operations — like facilitating vehicle sales, financing, insurance and repairs.

CDK serves more than 15,000 retail locations across North America, according to the company. Whether all of these locations were impacted by this week’s cyberattacks remains unclear.

RELATED COVERAGE Car dealerships are being disrupted by a multi-day outage after cyberattacks on software supplier So long plastic air pillows: Amazon shifting to recycled paper filling for packages in North America 1 Malaysian climber dead, 1 rescued near the top of Denali, North America’s tallest mountain

What happened last week?

CDK is investigating a Wednesday “cyber incident” and the company shut down all of its systems out of an abundance of caution, according to spokesperson Lisa Finney.

“We have begun the restoration process,” Finney said over the weekend in a prepared statement. “Based on the information we have at this time, we anticipate that the process will take several days to complete, and in the interim we are continuing to actively engage with our customers and provide them with alternate ways to conduct business.”

The company has warned customers about “bad actors” posing as members or affiliates of CDK to try to obtain system access by contacting customers. It urged them to be cautious of any attempted phishing.

Are impacted dealerships still selling cars?

Several major auto companies — including Stellantis, Ford and BMW — confirmed to The Associated Press that the CDK outage had impacted some of their dealers, but that sales operations continue.

In light of the ongoing situation, a spokesperson for Stellantis said that many dealerships had switched to manual processes to serve customers. That includes writing up orders by hand.

A Ford spokesperson said that the outage may cause “some delays and inconveniences at some dealers and for some customers.” However, many Ford and Lincoln customers are still getting sales and service support through alternative routes being used at dealerships.

Group 1 Automotive Inc., which owns 202 automotive dealerships, 264 franchises, and 42 collision centers in the U.S. and the United Kingdom, said Monday that the incident has disrupted its business applications and processes in its U.S. operations that rely on CDK’s dealers’ systems. The company said that it took measures to protect and isolate its systems from CDK’s platform.

All Group 1 U.S. dealerships will continue to conduct business using alternative processes until CDK’s dealers’ systems are available, the company said Monday. Group 1’s dealerships in the U.K. don’t use CDK’s dealers’ systems and are not impacted by the incident.

With many details of the cyberattacks still unclear, customer privacy is also at top of mind — especially with little known about what information may have been compromised this week.

In a statement sent to the AP on Friday, Mike Stanton, president and CEO of the National Automobile Dealers Association said that “dealers are very committed to protecting their customer information and are actively seeking information from CDK to determine the nature and scope of the cyber incident so they can respond appropriately.”