Notable clients impacted include General Motors dealerships, Group 1 Automotive, and Holman, which operates across eight states.
Notable clients impacted include General Motors dealerships, Group 1 Automotive, and Holman, which operates across eight states.
A spokesperson from CDK said, "We are currently addressing a cyber incident. To ensure the safety of our customers, we've temporarily disabled most of our systems and are striving to restore them as swiftly as possible."
By Wednesday afternoon, CDK announced that certain systems were back online after thorough tests and consultations with cybersecurity experts.
"Our primary dealer management system and Digital Retailing solutions are operational again. We are rigorously testing all other applications and will continue to update as we reactivate them," CDK reported to CBS MoneyWatch.
The dealer management system (DMS) from CDK is essential for overseeing all dealership activities through a unified interface, and its retail tools support transactions both online and in the showroom.
On its website, CDK boasts of a robust cybersecurity approach with a three-tier strategy focused on preventing, defending against, and responding to cyber threats to safeguard dealership operations.
The cyberattack, which began Tuesday evening, was first reported by Bleeping Computer, a cybersecurity news outlet. It affected CDK's ability to service the 15,000 dealerships dependent on its systems.
The attackers' identities have yet to be determined.
Following the incident, some dealerships have turned to manual operations. According to discussions on Reddit, employees are using spreadsheets and sticky notes for handling minor sales and repairs, although major transactions are severely affected.
One employee asked, "How many of you are standing around because your whole shop runs on CDK?" with users from dealerships in Wisconsin and Colorado confirming their systems were down.
TechEchelon Staff bylines are produced collectively by the newsroom for short, breaking, and wire-style coverage. Longer-form reporting is published under the responsible reporter's name.
More from the Staff →CISA has confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise flaw that allows unauthenticated remote attackers to manipulate files, and ordered federal civilian agencies to patch by Sunday under Binding Operational Directive 26-04.
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customer Salesforce environments on June 12, as the newly emerged Icarus extortion group publicly claims responsibility and the list of affected organizations continues to grow.
Human Rights Watch obtained Bulgarian export licensing records showing surveillance firm Circles sold phone-interception and geolocation tools to ten governments — including the UAE, Bahrain, and Azerbaijan — between 2018 and 2023, raising fresh questions about the EU's export control enforcement.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.