top of page
Search

CDK Global Cyberattack 2024: Vendor Concentration and Industry-Wide Disruption

Writer: Rebecca Guy
Rebecca Guy
Jul 23, 2024
5 min read

One software company went down and roughly 15,000 car dealerships went back to pen and paper in the middle of quarter-end. A restoration that got knocked down mid-recovery, a reported $25 million ransom, and over a billion dollars in dealer losses that the ransom did nothing to prevent.


Case type: Ransomware / SaaS supply chain outage     

Identified: Jun 18, 2024   Disclosed: Jun 19, 2024

Attribution: BlackSuit (Royal / Conti lineage)




On the morning of June 19, 2024, thousands of car dealerships across North America discovered they could not sell a car, finance a car, order a part, book a service appointment, or, in some cases, run payroll. Nothing was wrong with their computers. Something was wrong with their vendor's.


The ransomware attack on CDK Global is this series' second study in supply chain concentration, and the operational twin of MOVEit. Where MOVEit showed one flaw leaking thousands of organizations' data, CDK showed one outage stopping an entire industry's work: roughly 15,000 dealerships, about half the North American market, run their core operations on CDK's hosted dealer management system, and for roughly two weeks, through the quarter's biggest sales days, that system did not exist. The episode also carries two lessons the MOVEit story doesn't: what happens when recovery starts before eradication finishes, and what a reported $25 million ransom actually buys when the losses are already running past a billion.




BlackSuit ransomware, operated by a group descended from the Royal and Conti operations, hit CDK on June 18, 2024. CDK responded by shutting down most of its systems, taking the dealer management platform dark for its entire customer base. How the attackers got in has never been publicly disclosed, a nondisclosure this series has met before, and the analysis below treats it accordingly.


What happened next is the incident's most instructive failure. On June 19, with restoration underway, a second incident forced everything back down. Recovery had begun before the environment was clean, and the attackers, still present or still able to act, demonstrated it. The two-week outage that followed was born in that sequencing error as much as in the original breach: eradication, then recovery, is the order, and reversing it converted an outage measured in days into one measured in weeks, across an industry.



The demand reporting varied, from an initial $10 million to figures above $50 million as negotiations proceeded, and CDK itself said little. The blockchain said more. On June 21, three days in, investigators at TRM Labs traced roughly 387 bitcoin, then worth about $25 million, into a wallet linked to BlackSuit, routed through an intermediary firm that handles ransom negotiations. CDK has never confirmed a payment, and this post treats it as reported rather than established. What is established is that restoration still took nearly two more weeks: hosted platforms serving thousands of customer instances do not simply switch back on, decryptor or not.









Availability is the supply chain risk nobody prices


Third-party risk programs, where they exist, mostly ask what a vendor stores: whose data, how sensitive, breached how. CDK poses the other question: what does the vendor operate, and what happens the day it doesn't? The dealerships had lost no data of their own and suffered no intrusion of their own. They had lost a capability, completely and simultaneously with every competitor who shared the vendor, at the moment in the quarter when it cost the most. MOVEit's lesson was that your data lives where your vendors put it. CDK's is that your ability to function does too.


One vendor's bad month became an entire industry's.

Concentration did the multiplying. A dealer management system is a natural monopoly-shaped product: deep integration, high switching costs, and network effects push an industry onto a handful of platforms, and CDK held roughly half the market. That's efficient right up until it's a target, because from the attacker's chair, a vendor with 15,000 dependent businesses is 15,000 ransoms in one negotiation. The industries most proud of their standardization, healthcare clearing, title insurance, dealer management, are precisely the ones that have pre-aggregated themselves for the attacker's convenience.





Recovery started before eradication finished


The June 19 re-compromise deserves its own section because it is the incident's most transferable technical lesson, and its most human one. The pressure to restore was immense: an industry screaming, revenue hemorrhaging, headlines running. Under that pressure, restoration began while the attackers could still act, and the result was the worst of both worlds, a longer total outage plus a demonstration to the attackers of exactly how much leverage they held. Incident response doctrine orders the steps for a reason: contain, eradicate, then recover. Every hour that ordering adds feels unbearable mid-crisis, and it is cheaper than doing recovery twice. Organizations should decide before the crisis who holds the authority to say “not yet” to their own restoration, because that person will be the least popular one in the building at the moment they are most correct.







Not one decision. A set of conditions.


With the entry vector undisclosed, the honest analysis lives in the conditions that turned one vendor's breach into an industry's fortnight:





An industry rediscovered its manual gears


What kept cars selling at all was the same resource that carried MGM's casinos: people improvising. Deals were written by hand and hand-carried to lenders, service departments ran on printed tickets and phone calls, and some stores taped handwritten signs to service desks. Dealers with recent memory of paper processes, and staff who had once used them, fared measurably better than fully digital-native operations with no analog muscle at all. The continuity lesson from MGM's post repeats at industry scale, with one addition: when the outage is your vendor's, its length is not yours to control. The fallback has to be sized for someone else's recovery timeline, and their incentives to estimate that timeline optimistically are not your incentives.










"Concentration Is a Threat Model."


The CDK attack is remembered as the auto industry's worst technology outage, and it should be studied as something more general: the day a sector discovered it had a single point of failure it had never named. No dealership was breached, and every dealership was a victim. The ransom, reportedly paid within days, changed almost nothing about the two weeks that followed, because hosted platforms recover at the speed of engineering, not extortion. And the sharpest failure was self-inflicted twice over: an industry that concentrated its operations without pricing the risk, and a recovery that started before the environment was clean.


For every organization downstream of a dominant vendor, and that is now every organization, CDK sets the questions: what does two weeks without them cost, who rehearsed the paper version, and who is allowed to slow your own restoration down until it will actually hold. The attackers only had to win once to beat an industry. The defense is refusing to be pre-aggregated for them.


BECAUSE WHEN AN INDUSTRY RUNS ON ONE SYSTEM, THE ATTACKER ONLY HAS TO WIN ONCE TO BEAT EVERYONE.



Sources


Comments

bottom of page