Analyst assessment
CDK Global’s June 2024 cyber incidents interrupted dealership software and disrupted vehicle sales, repairs, inventory and accounting across the United States. Cyber involvement and substantial downstream effects are confirmed. Ransomware and BlackSuit attribution are supported by reporting based on unnamed sources, with medium confidence; CDK did not publicly confirm the operator.
CDK told Reuters on June 19 that it had shut systems while investigating and temporarily restored core dealer-management and digital-retailing services. It subsequently confirmed a second incident that day and another shutdown. The company’s roughly 15,000 North American retail locations were its customer footprint, rather than a verified count of dealerships that closed.
Operational significance
AutoNation, Lithia and Sonic disclosed disrupted dealer-management functions and continued operations using alternatives. Sales, service, inventory, customer management and accounting depended on the affected platform. Lithia reported no identified compromise of its own network.
The distribution of effects matters. Penske identified its Premier Truck Group as affected; its U.S. and international automotive dealerships did not use CDK’s dealer-management system. Group 1 reported U.S. disruption while its U.K. operations used another system. Asbury’s Koons dealerships also used a different platform. Holman told Reuters its phone system was affected.
Recovery extended beyond the early July reconnection targets. Asbury’s quarterly report says its CDK functions were restored July 8, followed by other integrations in subsequent weeks. AutoNation’s July 15 filing still described limited or unavailable ordering, scheduling, payment and reporting integrations.
A July 30 CDK update reproduced by ComplyAuto said major applications were available but integrations were nearly complete. Sonic later reported access to all its affected systems by July 31. These milestones support substantial recovery, without establishing one completion date for every customer and feature. The historical incident is presumed resolved.
AutoNation’s 2024 annual report gives more precise milestones for that customer: core functions returned June 29, ancillary systems by the end of July, and residual effects by the end of the third quarter. It reported about $43 million in costs, mainly compensation for commission-based employees, and estimated a $1.75 reduction in 2024 earnings per share before potential recoveries. These are AutoNation’s costs and estimates, rather than an industry-wide loss total.
In its Feb. 6, 2026, earnings release, AutoNation reported receiving $80 million in cyber insurance recoveries during 2025 for business interruption and related losses from the CDK outage. The later receipts document a financial consequence of the 2024 event; they do not establish renewed disruption or a ransom payment.
Confidence and uncertainty
Confidence is high in the operational findings because CDK’s acknowledgments and affected customers’ filings corroborate them. June 19 is the documented discovery and public-disclosure date. Contemporary reporting places the initial activity the preceding night, but the precise first-access time remains unknown.
CDK’s Sept. 20 vendor notification confirms that an unauthorized party copied vendor-related files containing names, addresses and tax or Social Security numbers. That finding does not establish that dealership customers’ information was copied. The later notice also does not extend the operational outage.
BleepingComputer’s June 22 report attributed the attack to BlackSuit and described negotiations for decryption and nondisclosure, citing multiple unnamed sources. That is media attribution, without an authenticated public victim-list post. CDK did not confirm the group.
Analytic gaps
The initial-access method, exact encryption scope, complete affected-data population and final recovery date remain unestablished. Precautionary customer disconnections do not prove attackers entered every dealership network.
CyberScoop reported that blockchain researchers traced about $25 million in bitcoin to a BlackSuit-linked wallet on June 21. The evidence did not conclusively establish CDK as the payer, and the company did not confirm payment. Later financial losses, notifications and litigation do not independently establish continuing technical disruption.
