CDK Global Cyberattack Auto Dealership Litigation

CDK Global provides dealer management system (DMS) software that is the operational backbone for an estimated 15,000 franchised auto dealerships across the United States. In mid-June 2024, a ransomware attack attributed to the BlackSuit cybercriminal group forced CDK to take its entire platform offline in two successive incidents within 24 hours. The outage lasted approximately 19 days and brought dealership operations — including vehicle sales, financing, service scheduling, and payroll — to a near-complete standstill. Reports indicated CDK paid a ransom of approximately $25 million to restore services. Consumer plaintiffs allege that their personally identifiable information (PII), including Social Security numbers, financial data, and driver's license information stored in the DMS, was exfiltrated during the attack.

Two distinct plaintiff classes have emerged: (1) auto dealerships and their owners seeking compensation for massive business interruption losses — industry estimates placed total economic harm to dealerships at over $1 billion — and (2) individual consumers whose PII was exposed. Plaintiffs allege CDK failed to implement adequate cybersecurity measures despite known vulnerabilities and prior warnings. The cases have been consolidated in the Northern District of Illinois, and CDK faces claims under negligence, breach of contract, and various state consumer protection statutes. The litigation is in early stages as of 2025, with class certification briefing ongoing.