CDK Global Ransomware (Jun 2024): 15,000 US Auto Dealerships Offline for 10+ Days

Incident summary

CDK Global, a dealer management software (DMS) vendor used by approximately 15,000 US automotive and powersports dealerships, was hit by ransomware on June 19, 2024. The SaaS DMS platform that CDK Global operates handles sales transactions, service work orders, parts inventory, accounting, dealer-side financing processing, customer relationship management, and inventory management across the affected dealer network. The intrusion took the SaaS platform offline across all customer dealerships for more than 10 days, with partial restoration phasing through late June and full restoration by early July 2024.

Public reporting from Bloomberg on June 21, 2024 attributed the intrusion to BlackSuit, a Russian-language ransomware-as-a-service group. BlackSuit is the rebranded continuation of Royal Ransomware, which was the subject of CISA-FBI joint cybersecurity advisory AA23-061A originally issued in March 2023 and updated for BlackSuit in 2024. Bloomberg's reporting also indicated that BlackSuit had demanded tens of millions of dollars in ransom. Bloomberg's June 21, 2024 reporting cited the ransom payment at approximately $25 million in bitcoin, paid by CDK Global. CDK Global has not formally confirmed the payment amount or the actor attribution in its public statements.

CDK Global initially attempted recovery on June 19, 2024 but suffered a second intrusion attempt during the recovery process, which extended the downtime. The second intrusion attempt was disclosed in CDK Global public statements without technical detail on the vector or the actor. The customer-side operational impact across the affected dealership network was severe. Dealerships reverted to paper-based sales transactions, hand-written service work orders, manual parts inventory tracking, and paper-based financing documentation. Anderson Economic Group estimated the cumulative US auto dealership revenue impact at approximately $1 billion across the downtime window.

Attack technique

Per CISA-FBI advisory AA23-061A on BlackSuit (and Royal) ransomware TTPs, the affiliate playbook combines initial access via valid accounts (T1078), exploitation of public-facing applications (T1190) where unpatched edge infrastructure is available, post-compromise reconnaissance, lateral movement, credential harvesting, data exfiltration to attacker-controlled cloud storage (T1567.002), and final ransomware deployment (T1486). Initial access vectors documented in the advisory include phishing, exposed Remote Desktop Protocol (RDP) endpoints, and exploitation of unpatched edge appliances. The CDK Global initial access vector has not been publicly confirmed by CDK or by federal advisories.

Post-compromise, BlackSuit affiliates use Cobalt Strike for command-and-control, run reconnaissance with built-in Windows administrative tools, and perform credential harvesting via Mimikatz and equivalent tooling. Lateral movement uses PsExec, WMI, and Server Message Block (SMB) abuse. Persistence is established through scheduled tasks, service installations, and account creation. The dwell time between initial access and ransomware deployment in BlackSuit operations typically runs days to weeks. The CDK Global case follows the pattern, though specific dwell time has not been publicly disclosed.

Ransomware deployment (T1486) targets file servers, database servers, and SaaS-hosting infrastructure to maximize the encryption footprint. BlackSuit binaries disable volume shadow copies and modify backup catalogs to inhibit recovery (T1490). The CDK Global multi-day recovery timeline indicates that the encryption affected a substantial portion of CDK's SaaS-hosting infrastructure, and that recovery required rebuilding services from offline backup tiers and reconstructing systems rather than simply decrypting in place. The second intrusion attempt during initial recovery, disclosed in CDK Global statements without further detail, suggests that the actor retained access to some CDK infrastructure during the initial recovery work.

The SaaS-vendor compromise pattern at CDK Global is operationally distinct from a typical enterprise ransomware victim. CDK Global serves approximately 15,000 dealer customers from a centralized SaaS infrastructure. A compromise of that centralized infrastructure produces near-simultaneous downtime across all 15,000 customers, multiplying the cumulative customer impact relative to the per-victim cost of compromising 15,000 individual dealerships. The pattern is operationally analogous to the Kaseya VSA incident in 2021 and the SolarWinds Sunburst incident in 2020, where compromise of a single vendor produced cascading impact across the vendor's customer base.

Impact and consequences

Customer-side operational impact across approximately 15,000 dealerships was severe. Sales transactions during the downtime were processed on paper, with subsequent reconciliation work that ran for weeks after CDK Global restored service. Service department work orders were hand-written and tracked in spreadsheets. Parts inventory tracking reverted to manual counts, with subsequent reconciliation against the restored CDK Global inventory data after service restoration. Dealer-side financing processing, which depends on CDK Global integration with lender systems, was substantially impaired during the downtime. New vehicle sales at affected dealerships declined materially during the downtime window.

Anderson Economic Group's estimate of approximately $1 billion in cumulative US auto dealership revenue impact captures the order of magnitude of the downstream business cost. The figure is per-dealer revenue impact aggregated across the affected network. Individual dealer financial impact varied widely depending on dealer size, monthly transaction volume, and the dealer's specific dependence on CDK Global for revenue cycle operations. Larger publicly-traded auto retail groups including AutoNation, Group 1 Automotive, Lithia Motors, and Sonic Automotive disclosed CDK-related operational impact in their Q2 2024 and Q3 2024 earnings reports.

CDK Global's own financial impact was substantial. The reported $25 million ransom payment, while a substantial figure, is small relative to the operational and remediation costs of the downtime and to the litigation exposure from affected dealer customers. CDK Global has not publicly disclosed its full incident-related financial impact since the company is privately held and does not publish detailed financial reporting. Trade press reporting indicated significant customer churn risk and contractual renegotiations through late 2024 and into 2025.

Litigation consequence was extensive. Class action lawsuits filed within weeks of the intrusion alleged that CDK Global had inadequate cybersecurity controls, that the SaaS architecture concentration risk had not been adequately disclosed to dealer customers, and that affected dealers were entitled to compensation for the operational and revenue impact. The litigation continued through 2024 and into 2025. The case became a reference point in the broader SaaS-vendor concentration risk conversation, alongside the Sisense incident, the Snowflake customer breaches, and the Microsoft Midnight Blizzard intrusion.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

SaaS-vendor concentration risk is a real and quantifiable business risk that requires explicit assessment. CDK Global's compromise produced near-simultaneous downtime across approximately 15,000 dealer customers because all customers depended on a single centralized SaaS infrastructure. Customers that depended on CDK Global without architectural fallback could not operate normally for the duration of the downtime. Evaluate every business-critical SaaS dependency for the same concentration risk pattern. Where the risk is material, architect for fallback: secondary SaaS providers, on-premise alternatives, paper-based business continuity procedures, or contractual SLA terms that produce financial compensation for extended downtime.

Paper-based business continuity procedures need to be pre-tested at scale. Dealers reverted to paper-based sales, service, parts, and financing operations during the CDK Global downtime, and the subsequent reconciliation work after service restoration was substantial. Pre-test paper-based business continuity at full operational scale before the first incident, including the reconciliation procedures after service restoration. The cost of inadequate pre-testing is severe operational friction during the downtime and substantial reconciliation cost after restoration.

Ransomware actor re-intrusion during recovery is a documented pattern, not an edge case. CDK Global suffered a second intrusion attempt during the initial recovery on June 19, 2024. The pattern is consistent with affiliate playbooks that retain persistence artifacts in environments where complete eviction has not been verified. Build into the incident response plan an eviction-verification step that confirms the actor's persistence artifacts (scheduled tasks, service installations, credentials, edge appliance configurations) have all been removed before restoring service. Restore service before eviction-verification, and re-intrusion during recovery is a real risk.

Vendor incident response coordination with customer base is a defensive control that benefits both vendor and customers. CDK Global's customer communication during the incident was reported in trade press as inadequate, with affected dealers reporting limited information about timeline, scope, and recovery progress. The customer communication friction amplified the operational and litigation impact of the incident. Build a vendor-incident customer-communication playbook before the first incident: who communicates what, on what cadence, through which channels. Regular cadenced communications during a downtime event reduces customer trust friction even when the technical news is not yet positive.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/incident-responder
• /careers/soc-analyst
• /careers/automotive-security-engineer
• /careers/threat-intelligence-analyst

Related Decipher Files

• Ascension Health Ransomware (May 2024): Black Basta Took Down 140 Hospitals
• Halliburton Ransomware (Aug 2024): RansomHub Hit US Oilfield Services Giant
• Snowflake Breaches 2024: Ticketmaster, AT&T, Santander Hit via Customer-Side Credentials

Frequently asked questions