What happened?
In the small hours of June 19, 2024, CDK Global — the software backbone for ~15,000 North American car dealerships — detected a cyber incident and shut its systems down. An initial intrusion was contained, restoration began, and then a second wave hit the recovering environment around June 22. From finance-and-insurance desk to service-bay scheduling, the retail American auto industry spent weeks running on paper forms, rotary phones and fax machines — a live, national demonstration of single-vendor concentration risk.
Quick Answer: CDK Global — the DMS platform most US dealerships run on — was ransomware-hit June 19 2024 and re-hit during recovery days later, blacking out sales, financing and service workflows for ~15,000 dealers for weeks; the outage cost the industry over a billion dollars and made “vendor concentration risk” a Main-Street story.
CDK’s Dealer Management System is the operational nervous system of a dealership: inventory, deal structuring, lender integrations, OEM ordering, service scheduling, payroll. When CDK went dark, the alternative was nothing connected. Dealers improvised — handwritten buyer orders, quote worksheets in Excel where laptops still worked, credit apps phoned into lenders. OEMs idled plants on the inventory-buffering margin; June is a peak sales month, sharpening the pain. Public filings and analysts’ estimates put industry losses north of a billion dollars; dealership groups quantified per-store revenue hits in SEC filings for quarters afterward.
The rehack timeline that defined the story
The second intrusion was the defining event. After the first shutdown, CDK’s responders (later confirmed included Mandiant) were restoring systems when attackers — widely linked to BlackSuit/ALPHV-offshoot reporting, though attribution stayed soft — re-entered, evidently through access that survived the cleanup. That forced a full second rebuild and extended the outage by well over a week. For the IR community it re-taught an old rule: restoration without eviction is re-victimization; you rebuild only as fast as you can prove the adversary is out.
| Date | Event |
|---|---|
| 2024-06-19 | First incident detected; CDK takes systems offline; dealerships switch to manual operations |
| 2024-06-20→21 | Partial restoration begins against hopeful timelines |
| 2024-06-22 | Rehack confirmed; second shutdown; “weeks not days” messaging lands — this post’s publish date |
| 2024-07-01→ | Phased dealer restores trickle through early-mid July; most dealers live by mid-July |
| 2024-H2 | Cost tally: $1B+ industry losses; lawsuits vs CDK; NADA and state dealer associations publish continuity playbooks |
Anatomy of concentration risk
The economics that made CDK’s outage national news were consolidation economics: one vendor, one or two dominant DMS products, an entire industry’s workflows standardized on them — plus OEM and lender integrations hard-wired to CDK’s APIs. Redundancy was neither cheap nor quick, because the integrations ARE the product. Regulators and industry groups spent the rest of 2024 drafting continuity expectations: tested manual fallback procedures, contractual uptime and incident-notification SLAs, and multi-vendor or escrowed-software strategies once considered paranoid. The uncomfortable truth survived every discussion: the industry chose efficiency and got fragility as the package deal.
- Continuity by hand: pre-printed deal paperwork, offline lender contact trees, daily data extracts held locally — dealers that had “day two” kits sold cars during the outage; others did not.
- Integration escrow: for SaaS that runs your business, demand exportable data formats and rehearsed restore-even-if-vendor-down paths.
- Recovery ≠ recovered: phase restores with monitoring for re-entry; treat any early recovery euphoria as a detection window, not a finish line.
- Concentration audits: map your critical-path vendors; if one name appears under every workflow, you have a CDK-shaped single point of failure — price it accordingly.
FAQ
Who attacked CDK, and was data stolen?
Attribution stayed unofficial; reporting leaned toward a BlackSuit/ALPHV-lineage crew, and ransom was evidently demanded and reportedly paid (figures in the tens of millions circulated, unconfirmed). CDK later confirmed significant data theft affecting employees and customers — the classic double-extortion pattern: weeks of operational pain on top of long-term data exposure.
Why couldn’t dealers just switch systems for a month?
Because a DMS is not software you use; it is software your business IS. Title work, OEM warranty claims, lender interfaces, service histories — all live inside CDK and its API web. Contractual lock-in plus integration lock-in meant the realistic fallback was paper, not competitors. That lock-in is precisely why the attack paid: same reason the following month’s CrowdStrike incident Hurt so broadly — chokepoints monetize (for attackers) exactly as they streamline (for users).
What did this cost, and who paid?
Estimates: roughly $1.1B+ in industry-wide losses (Anderson Economic Group), six-figure-to-eight-figure per-dealer-group hits in Q3 filings, and CDK’s own revenue/credit-rating damage. Allocation fights — dealers’ business-interruption claims vs carriers vs CDK contracts — kept lawyers employed through 2025. The economic afterlife proved the concentration thesis better than any whitepaper: fragility risk is a systemic externality that somebody always pays for.
The paper-workplace weeks as social studies
Beyond dollars, the outage became a media marvel precisely because it showed how thin the digital layer is over old commerce. Photos of handwritten buyer orders and Rolodex-style lender phone trees went viral; trade press ran “day in a manual dealership” diaries. Two durable observations stuck with planners. First, business continuity theater (binders unread since 2019) failed everywhere it had not been rehearsed. Second, the workforce variable dominated: dealers with 50-something office managers who remembered paper flows recovered fastest — an unplanned argument for cross-generational process knowledge that resilience programs now (belatedly) prize.
The filings trail that followed
The financial paper trail deserves its own record because it quantified concentration risk in a way regulators could cite. Public dealership groups (AutoNation, Lithia, Group 1, Sonic) filed 8-Ks and 10-Qs itemizing six-figure and seven-figure impacts; Anderson Economic Group’s $1.1B industry estimate became the reference number; and CDK’s own disclosures—employee and customer data stolen, litigation consolidated—filled in the victim side. Insurance markets repriced business-interruption coverage for dealer groups almost immediately. When policymakers later asked for “evidence that vendor concentration is a systemic risk,” the CDK docket was the ready-made exhibit.
Placement in the timeline
June 2024 sits dense in this series: Snowflake’s extortion peak (p10) showed cloud identity as entry; CDK showed what initial access does to an industry spine; Brain Cipher (p07) showed nation-scale government versions of the same fragility. Together they close the argument the timeline has been building all year — the 2020s’ structural risks are concentration and identity, and ransomware is simply their most efficient pricing mechanism. CDK’s paper weeks, like Ticketmaster’s 560 million records, are line items in that invoice.
