Thousands of car dealerships in limbo during peak-buying season after second cyberattack wallops industry

“At this time, we do not have an estimated time frame for resolution, so our merchants’ systems will likely be unavailable for several days,” the company said in a letter sent to customers on Thursday that was reviewed by Bloomberg.

A CDK spokesperson did not immediately respond Thursday to an email and phone message inquiring about the letter it sent to customers.

CDK notified customers on Thursday of the incident that occurred late the previous evening. The company shut down most of its systems again, initially saying that its dealer systems “will be unavailable at least through Thursday.”

In what would have been a busy holiday for US business, dealers relying on CDK were unable to use its systems to complete transactions, access customer records, schedule appointments, or handle auto repair orders. Serving the company Nearly 15,000 agentsand support front-office sales representatives, back-office support staff, and parts and service stores.

The outage also extended to hundreds of dealerships in Canada, where retailers rely on pen and paper to work through deals, said Tim Royce, president of the Canadian Automobile Dealers Association. These transactions will eventually need to be recorded digitally once systems come back online, he said.

“There will be some residue from this incident,” he added.

AutoNation Inc. Shares of listed agent groups fell on Thursday, falling as much as 4.6% in intraday trading. Shares of Lithia Motors, Group 1 Automotive and Sonic Automotive also declined.

CDK is among a small group of companies that provide dealer management systems to auto retailers, along with Reynolds & Reynolds Co. and Dealertrack, a unit of Cox Automotive.

Agents reported varying degrees of impact on Thursday, with some saying in social media posts that they were not affected by the hack. Others said they were still experiencing disruptions even though they used DMS systems from CDK competitors.

Greg Thornton, general manager of a dealership group in Frederick, Maryland, said his stores' CDK customer relations software had been down since early Wednesday morning.

“I can only assume that CDK is working hard to solve this problem,” said Thornton, whose group includes Audi and Volvo stores. “We have not had any conversations with them in person or on the phone.”

Open Road Auto Group's 19 dealerships in New York and New Jersey use Reynolds & Reynolds, but have been unable to deliver new cars since the outage began Wednesday, said Michael Moraes, president of the dealership group.

That's because other CDK services outside the core DMS are also down, he said, including the service that connects dealerships with state motor vehicle departments for title and registration.

“We are frustrated with CDK because they should have better precautions,” Moraes said.

Sam Pack's Five Star Chevrolet out of Dallas sold four vehicles Wednesday despite the initial outage, but has had to adapt, such as handling some tasks on paper until service is restored, said Alan Brown, the store's general manager. While sales staff are able to provide approvals to lenders, the outage has prevented other elements of the transaction, such as obtaining title deeds.

“We're still going about our business,” Brown said. “It's not our natural flow.”

CDK has not yet provided a timeline for when its systems will be available again, he said.

The National Automobile Dealers Association said Wednesday that it is actively seeking information from CDK to determine the nature and scope of the cyber incident.

CDK has been spun off from Automatic Data Processing Inc. In 2014, it was then agreed to be acquired in April 2022 by investment firm Brookfield Business Partners in an all-cash deal of $6.4 billion.