Major Breakdown: Ransomware Attack Costs Auto Industry $944M, Report Estimates

The automotive industry lost approximately $944 million dollars in the first three weeks following a major ransomware attack on auto dealership software provider CDK Global, according to a new report that offers a sobering look into just how a financially damaging a cyber incident can be on an entire business sector.

According to the July 1 report from East Lansing, Mich.-based research and consulting firm Anderson Economic Group (AEG), the June 19 attack by the BlackSuit ransomware cybergang caused auto dealers $284 million in losses by the end of the first selling week. Another $321 million was lost during week two, and attack’s aftermath was estimated to be even worse in week three, with $339 million in total losses (though this last number was still subject to change depending on precisely when service was restored).

Much like past ransomware attacks against Colonial Pipeline and Change Healthcare/UnitedHealth Group, the ransomware attack against CDK Global affected not just the infected organization, but many downstream business partners – in this case, the roughly 15,000 North American auto dealerships that use CDK’s cloud-based software services for various business functions ranging from retail sales to repairs to finances.

CDK itself also took a large hit, reportedly paying a $25 million ransom to the malicious hackers (though this payment was not incorporated into the $944M estimation). The initial attack caused the company to take its systems offline, forcing its clients to conduct business manually on pen and paper – greatly impeding their ability to operate efficiently and profitably. Systems were largely restored in early July.

When calculating the damages to the auto dealerships, AEG considered a multitude of factors, including lost earnings from car sales, servicing appointments, and service and parts sales that were delayed or did not take place. Moreover, AEG considered “additional staffing costs, outside IT services, overtime and outside staffing costs, floor plan interest on inventory (vehicle and parts) that are delayed or interrupted before sales, and additional financing costs for the dealership operation during the time of interruption,” the report stated.

And the losses could potentially be even worse. The report doesn’t even consider losses of follow-on services or sales; reputational damage to dealers; exposure of customers’ personal information; losses to automakers, transport companies and suppliers; and legal costs, among other factors. 

In October 2023, CDK Global released its third-annual 2023 State of Cybersecurity in the Dealership Study, which warned of a growing number of cyberattacks against the automotive industry. According to the report, 17% of 175 surveyed auto dealers had experienced a cyberattack or incident within a year of when the poll was conducted. Ransomware was named the third biggest threat by survey-takers, behind email phishing scams and lack of employee awareness. 

To create its report, AEG used information that was available as of June 27. AEG said it would revise its estimates as more details become public.