BlackSuit strikes CDK Global, leaving dealerships without their standard tools

What happened

On 27 June 2024 Reuters reported that the BlackSuit group was behind the attack on CDK Global, a software provider used by car dealerships in the United States. The disruption forced many customers to rely temporarily on manual processes for sales and administration.

The attack hit a platform widely used across the sector, which amplified the impact: numerous dealerships dependent on the same provider were affected simultaneously, struggling to process sales, financing and routine paperwork.

What it means for a mid-sized business

Dependence on a widely used vertical application in a sector can become a shared operational risk: when a specialised software provider suffers an incident, all its clients in that sector are affected at the same time.

For businesses using similar specialised software, such as workshops, distributors or shops with sector-specific management systems, the case illustrates the importance of knowing how long the business can run without that system and what manual alternative exists while the incident is resolved.

What to review

Steps applicable to any business with critical vertical software:

• Which business processes depend entirely on a single software provider.
• How long operations can continue with manual procedures.
• What copies or records exist outside the provider's system for emergencies.
• What communication exists with the provider about its continuity plans.

Frequently Asked Questions

Who is BlackSuit?

A ransomware group Reuters attributed the attack against CDK Global to in June 2024.

How did it affect dealerships?

Many had to temporarily rely on manual processes for sales and administration while CDK Global restored its systems.

What lesson applies to other sectors using specialised software?

Knowing the real dependence on each vertical application and having a tested, not just theoretical, alternative manual procedure.