Celebrity group's 4 dealerships sue CDK over cyberattack

Celebrity Motor Car Co.'s four franchised dealerships all have sued CDK Global, accusing it of soliciting business by stressing the risks of a dealership breach and the cybersecurity CDK could provide — only to be hacked itself and unavailable to retailers after the June breach.

"Unquestionably, CDK knowingly failed to implement adequate or even reasonable security measures, despite its declarations of vigilance and its own touted experience and expertise in the cybersecurity arena," the Celebrity stores wrote in their lawsuit.

"As a result, CDK knew or should have known that its systems were susceptible to invasion and that there was a reasonable likelihood that Celebrity's businesses would be substantially disrupted."

The case was originally filed in Morris County New Jersey Superior Court on July 16 but was moved to the U.S. District Court of New Jersey on Aug. 16. That court sent the case to arbitration the same day.

CDK did not return an email request for comment Aug. 29 on behalf of it and subsidiary IP Networked Services, which also was named as a defendant. However, the two companies wrote in their Aug. 16 request to move the case to federal court they "of course dispute that plaintiffs are entitled to any damages whatsoever."

Lexus of Route 10 in Whippany, BMW of Springfield and Celebrity Ford of Toms River in New Jersey and Mercedes-Benz of Goldens Bridge in New York accused CDK and its subsidiary of: fraudulent inducement; breach of the covenant of good faith and fair dealing; tortious interference with prospective economic advantage; misrepresentation; unjust enrichment; and violating the New Jersey Consumer Fraud Act or, alternatively, a violation of the Illinois Consumer Fraud Act.

According to the dealerships' lawsuit, CDK in 2021 pitched Celebrity, which was already a CDK customer, to expand the stores' information technology services, "including cybersecurity solutions to guard against cybersecurity threats and to protect Celebrity's IT systems from an interruption that would compromise and/or debilitate the business functions of Celebrity's Dealerships."

Celebrity said CDK told the group how frequently cyberattacks occurred, how a system outage could halt the stores' operations and the risk of customers defecting from a dealership after their data was compromised.

"Not only did CDK seek to raise Celebrity's fear of an IT interruption and the effect it would have on Celerity's business and customers, but CDK ... made clear to Celebrity that by further engaging with CDK and its IT solutions, Celebrity need not worry about the safety of its data, and that CDK's IT solutions were fully equipped and would protect Celebrity's most valuable assets.

"Indeed, CDK represented that it would provide a robust defense against threats targeting Celebrity utilizing a three-tiered approach: (i) a prevention layer that stops threats before they could penetrate into Celebrity's Dealerships; (ii) a protection layer that monitors and detects cyberattacks while blocking them before they can cause damage; (iii) and a response layer to contain any threat to Celebrity's business and allow Celebrity to recover quickly after an attack."

Celebrity's dealerships said the group "was induced to continue/extend and/or expand its relationships with CDK at its various Dealerships."

CDK Global suffered two cyberattacks June 19 in what it called a "cyber ransom event" and shut down its software as a precautionary measure. It began bringing dealerships back online June 29 and said most customers were back online as of July 2.

"We are pleased to report that after conducting a thorough third-party expert review of the June 19th cyber incident, we have not discovered a compromise of reportable dealer employee or consumer personally identifiable information that would give rise to any notification obligations relating to the incident," a CDK spokesperson told Automotive News in an Aug. 26 emailed statement.

"Dealers can now reassure both their employees and consumers that their data is secure and continue to focus on providing excellent experiences throughout the car buying and owning journey."

Celebrity said the CDK shutdown came "without notice" and caused "the entirety of Celebrity's business operations at all [of] its Dealerships to come to a grinding halt and creating a substantial crisis for Celebrity." The group said its operations were still "impaired" as of the July 16 lawsuit.

CDK said in a July 11 statement that all of its "major applications are now available," and CEO Brian MacDonald told Automotive News that as of July 18, "most OEM integrations have been re-established and nearly 90 percent of the third-party software integrations are now active."

The lawsuit said during the outage CDK "was unable to remediate the interruption of its services, contrary to representations made while inducing Celebrity to purchase additional services, provided no guidance to Celebrity, and all of CDK's support lines and means of communication directly to CDK, were shut down. In short, CDK, during the Crisis, remained unavailable to provide any guidance or remediation whatsoever.

"There is no question that CDK's failure to provide services to Celebrity caused and is causing not only irreparable harm to Celebrity's good will, reputation and relationship with its customers, but also substantial monetary losses, all of which are ongoing and cumulative."

Celebrity accused CDK of "a massive fraud so as to unlawfully induce [Celebrity], and likely other similarly situated automobile dealerships, to enter the MSAs and other agreements with CDK so as to obtain payment of sums to which it was not otherwise entitled."