Notable clients impacted include General Motors dealerships, Group 1 Automotive, and Holman, which operates across eight states.
Notable clients impacted include General Motors dealerships, Group 1 Automotive, and Holman, which operates across eight states.
A spokesperson from CDK said, "We are currently addressing a cyber incident. To ensure the safety of our customers, we've temporarily disabled most of our systems and are striving to restore them as swiftly as possible."
By Wednesday afternoon, CDK announced that certain systems were back online after thorough tests and consultations with cybersecurity experts.
"Our primary dealer management system and Digital Retailing solutions are operational again. We are rigorously testing all other applications and will continue to update as we reactivate them," CDK reported to CBS MoneyWatch.
The dealer management system (DMS) from CDK is essential for overseeing all dealership activities through a unified interface, and its retail tools support transactions both online and in the showroom.
On its website, CDK boasts of a robust cybersecurity approach with a three-tier strategy focused on preventing, defending against, and responding to cyber threats to safeguard dealership operations.
The cyberattack, which began Tuesday evening, was first reported by Bleeping Computer, a cybersecurity news outlet. It affected CDK's ability to service the 15,000 dealerships dependent on its systems.
The attackers' identities have yet to be determined.
Following the incident, some dealerships have turned to manual operations. According to discussions on Reddit, employees are using spreadsheets and sticky notes for handling minor sales and repairs, although major transactions are severely affected.
One employee asked, "How many of you are standing around because your whole shop runs on CDK?" with users from dealerships in Wisconsin and Colorado confirming their systems were down.
TechEchelon Staff bylines are produced collectively by the newsroom for short, breaking, and wire-style coverage. Longer-form reporting is published under the responsible reporter's name.
More from the Staff →Huntress discovered attackers exploiting a SQL injection flaw in an Apache Tomcat application to embed a post-exploitation toolkit called khunt directly inside an Oracle database, achieving SYSTEM-level command execution on the underlying Windows server.
A cyberattack on Apple supplier Tata Electronics has given Beijing a propaganda opening to cast doubt on India's manufacturing reliability, even as technicians in China's Huaqiangbei market admit they cannot replicate the iPhone 18 Pro from the leaked data.
Apple has filed a new legal challenge against a U.K. government demand to access encrypted data held by British customers, escalating a dispute that previously drew intervention from senior U.S. officials including President Trump and Vice President Vance.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.