A dealership in Phoenix is handwriting paper contracts and gauging creditworthiness with guesswork. A Jeep owner in Alabama keeps calling about when a replacement part will be in stock. A family in New Jersey is waiting for word on when they can take delivery of their new Audi.
Such is life for auto retailers and their customers across the United States and Canada after CDK Global — a software provider to some 15,000 dealers — was waylaid by debilitating cyberattacks. The barrage began Wednesday, costing U.S. dealers a burst of business on a federal holiday. CDK has warned that a second incident Thursday is likely to keep its systems down for several more days.
The attacks have had a crippling effect on an industry that topped $1.2 trillion in sales last year just in the United States. CDK’s core product — a suite of software tools referred to as a dealership management system, or DMS — underpins virtually every element of auto retailers’ day-to-day business.
There are only a handful of DMS providers for dealers to choose from after decades of consolidation. That’s left thousands of retailers highly reliant on each of the select few software companies that enable them to line up financing and insurance, manage vehicle and parts inventory, and complete sales and repairs.
CDK’s parent, Brookfield Business Partners LP, had its worst trading day since October, plunging 5.7% on Thursday. Stock in dealer group AutoNation Inc. fell 3.6%, their biggest drop in two months. Group 1 Automotive Inc., Sonic Automotive Inc. and Lithia Motors Inc. shares also slumped.
For Joshua Adams, the Jeep owner in Millbrook, Alabama, CDK’s outage comes at an inopportune time. He’d already gone weeks without his 2020 Renegade sport utility vehicle as he waited for a warranty claim to be sorted out.
This week, he called his dealership to check if the final part needed to fix his vehicle had arrived, as expected. The service center was unsure, saying it was impossible to know because of the hack.
“They can’t tell me where my part is or when it will arrive,” Adams said. “We are just up in the air.” He expects the delay will cost several hundred dollars in additional expenses for a rental car he’s driving in the meantime.
In Michigan, the outage was causing paperwork headaches at Champion-Hargreaves Chevrolet in Royal Oak, said dealer Walt Tutak. He said the cyberattack didn't appear to have prevented any car sales outright, but it was slowing the selling process because "we have to do more by hand."
"It's strictly the paperwork that's slowed down," he said. "We have to do a lot of things manual."
That included delivering registration paperwork daily in-person to the Michigan Secretary of State instead of sending the papers virtually, he said. The outage was also impacting parts ordering and warranties.
Not all dealers are facing the problems. Two Michigan dealers The Detroit News spoke with Friday, one selling Cadillac and Chevrolet, another Stellantis NV brands, said they felt lucky that they were using a different retail management software system, from the company Reynolds and Reynolds.
In New Jersey, the Lanni family was excited to take delivery of a new Audi Q5. Daniel Lanni and his wife had removed the child seats from their old vehicle so they’d be ready for plopping into the new SUV. But on Wednesday, their dealer called to say the store’s computer system was down, and it wasn’t clear when they’d be able to take delivery.
Lanni and his wife reinstalled the car seats for their children — ages 3, 5 and 8 — and said they hadn’t heard more from the dealer as of Thursday afternoon.
“The kids were really excited,” said Lanni, a 41-year-old commercial real estate broker. “They’re upset and now they’re just regularly asking about it.”
Alex Padron, a sales manager at a Nissan dealership in Phoenix, said that business was “almost at a standstill” on Thursday. Everyone who’s purchased a vehicle from the store since 2014 — when it began using CDK’s software — has data stored in the system, he said.
“It’s probably more than 50,000” customers, he said.
The dealership is handwriting paper contracts and finding novel ways to get deals done. He said workers in the finance department have had to “guess” customers’ creditworthiness based on “whatever information they can gather.”
Since the attack began, the dealership has been able to process about half the transactions it usually can. Anything complicated — say, a purchase involving a trade-in or unusual financing — simply can’t get done.
“For this store, I’d like to have 10 complete deals done a day,” Padron said. “Five, six, seven would be nice today.”
Detroit News Staff Writer Luke Ramseth contributed.
