INCIDENT REPORT · CP-2024-007
CDK Global auto dealer software cyberattack
L3 · ELEVATEDREPORTED
CDK Global, whose dealer management software is used by about 15,000 North American car dealerships, shut down most of its systems after a cyber incident on 19 June 2024 and a second incident that evening.
- Incident ID
- CP-2024-007
- Incident date
- 19 JUN 2024
- Detection date
- 19 JUN 2024
- Affected countries
- United States, Canada
- Plotted location
- Hoffman Estates, United States (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Sector-wide disruption to US auto retail through a single software provider.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Retail, Technology
- Critical infrastructure
- No
- Organizations affected
- CDK Global, About 15,000 auto dealerships in North America
- Operational consequences
- Dealerships lost access to sales, service and back-office systems for up to two weeks, and several publicly traded dealer groups disclosed the disruption to the SEC.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] CDK Global cyberattack cripples 15,000 US auto dealershipsHelp Net Security · helpnetsecurity.com · 20 JUN 2024
- [2] Car dealerships report CDK software ransomware attack to SECThe Record · therecord.media
- [3] CDK Tells Customers Dealer System Likely Down Until June 30Insurance Journal (Bloomberg) · amp.insurancejournal.com · 26 JUN 2024
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.