CDK Global Automotive Dealership Cyberattack Litigation

In June 2024, CDK Global — whose dealer management system (DMS) software is the operational backbone for roughly 15,000 car dealerships across the United States and Canada — suffered a devastating ransomware attack attributed to the BlackSuit cybercriminal group. The attack forced CDK to take its systems offline for nearly three weeks, bringing vehicle sales, financing, service scheduling, and payroll processing at thousands of dealerships to a near-complete halt. Industry analysts estimated the attack cost the automotive retail sector over $1 billion in lost revenue. Reports indicated CDK paid approximately $25 million in ransom to restore services, though the company has not publicly confirmed the payment.

Multiple class action lawsuits were filed in federal courts by both dealerships and consumers, alleging that CDK's failure to implement and maintain reasonable cybersecurity measures constituted negligence, breach of contract, and violation of state consumer protection laws. Consumer plaintiffs allege that their sensitive personal and financial information — including Social Security numbers, income data, and credit histories shared during vehicle financing — was exposed to criminals. Dealership plaintiffs seek compensation for lost profits, emergency IT costs, and reputational harm suffered during the extended outage. Cases have been consolidated in the Northern District of Illinois, and litigation is in early discovery phases.