Hyundai dealership customer sues CDK over cyberattacks

A Hyundai dealership customer on July 22 joined other consumers who have sued CDK Global, alleging their data was put at risk by the June 19 cyberattacks suffered by the dealership management system provider.

Ronaldo Proto's July 22 case in the U.S. Northern District of Illinois made him at least the 22nd consumer to pursue legal action in federal court against CDK related to the cyberattacks. Fifteen of the 22 are suing solely because of alleged injury they suffered as a consumer; the other seven are dealership employees who allege their information provided for their jobs and in their capacity as consumers had been compromised in the breach.

CDK did not immediately respond to an email July 26 seeking comment on the case.

Proto, of Connecticut, said he leased a vehicle this year from an unspecified "local" Hyundai dealership that used CDK, according to the complaint. He said this required him to give the dealership personal information including his name, Social Security number, contact information, work history and proof of income, and he alleged CDK received this data, too.

"Plaintiff and Class Members are now at a significantly increased and certainly impending risk of fraud, identity theft, and other harms caused by the unauthorized disclosure of their PII [personally identifying information] — risks which may last for the rest of their lives," according to Proto's lawsuit, which seeks class-action status allowing it to represent everyone in the U.S. whose personal information was "compromised in the CDK Data Breach."

CDK suffered at least two cyberattacks June 19 in what it called a "cyber ransom event." It took its software offline as a precaution, forcing thousands of dealerships to find alternative ways to do business. CNN reported CDK paid a ransom of about $25 million on June 21 to end the incident, though Proto's lawsuit said "criminals have no incentive to destroy such valuable information that may be monetized in the future, either through extracting additional ransom payments (from CDK), or using the data to commit fraud and identity theft."

CDK began restoring service to dealerships on June 26; by July 2, CDK announced "substantially all dealer connections" to the DMS had been restored.

"All major applications are now available," CDK said in a statement July 11. On July 18, CDK CEO Brian MacDonald wrote in an email that "nearly 90 percent" of third-party software connections were restored.

MacDonald, asked by Automotive News whether CDK has determined any theft of personal information, reiterated on July 18 that an investigation is continuing, using "leading third-party experts." But he said CDK hadn't discovered any stolen data "that triggers the reporting requirement under any federal, state or provincial laws."

Proto accused CDK of negligence, negligence per se and unjust enrichment. He also called for the court to render a judgment that CDK owed customers a duty to protect data but breached it, and to order CDK to "employ adequate security protocols consistent with law and industry standards" to protect customer information.