Cyberattacks Disrupt Car Sales by Dealers in U.S. and Canada

Thousands of auto dealers across the United States and Canada are suffering disruptions to their operations as a result of cyberattacks on a provider of critical software and data services used in auto retailing.

The provider, CDK Global, said it was targeted in two attacks on Wednesday, prompting the company to shut down its systems to prevent the loss of customer data and to allow testing and other measures to restore its services.

“We are assessing the impact and providing regular updates to our customers,” CDK Global said in a statement. “We remain vigilant in our efforts to reinstate our services and get our dealers back to business as usual as quickly as possible.”

CDK provides services to more than 15,000 retail locations. Its dealer management systems store customer records and automate much of the paperwork and data involved in selling and servicing cars and trucks.

Dealers said the outage had slowed sales and forced them to find alternative methods to produce the titles, contracts, leases, registration cards and other forms that must be delivered to customers, banks and state motor vehicle authorities.

“It is definitely annoying, no doubt,” said Brian Benstock, general manager and vice president of Paragon Honda in the New York borough of Queens. “But we’re still open for business. We’re still selling cars.”

He said his franchise had other systems to retrieve customer data. “We can produce contracts,” he said. “For customers, it’s pretty seamless.”

The disruption has come at a critical time for dealers as they head into the final two weekends of the month, typically a busy time for new-car sales. Many are also preparing for Fourth of July sales and other summer promotions.

Dealers said that in some cases they were reverting to writing contracts by hand, or asking customers to wait a few days to take delivery of their vehicles.

They have less leeway in servicing or repairing vehicles, when customers often expect their cars back within a few hours, but the lack of access to customer data in most cases won’t prevent technicians from performing repair work.