Editorial: In wake of CDK attacks, time to go on offense against cybercriminals

Large chunks of the U.S. auto industry suffered a rude awakening June 19 to the threat posed by criminal networks outside federal jurisdiction that exploit data security failures.

The attacks on leading dealership management system provider CDK Global are more than just a wake-up call for dealerships and their vendors to get their online houses battened down. They must also motivate industry leaders — and governments — to formulate creative defense strategies, or else such attacks will become commonplace, further eroding consumers' confidence in dealerships.

Crime and economic loss is nothing new to automotive retailing, but the scope has changed through the decades as dealerships have grown to rely on the efficiency of computing and connectivity. Just as those technologies have advanced with time, so too has the threat from bad actors eager to exploit security lapses. When the threats become organized — or are sponsored by rogue nations or groups — the loss potential can grow exponentially.

If dealers and their staffs felt powerless as they watched their vital CDK-based systems become inoperable, we can offer only this: You aren't alone. Ransomware attacks have hit sectors as varied as health care, transportation, defense and entertainment, and they have caused significant economic damage. Cyberattacks aren't limited to private industry: Western governments have also fallen victim.

Law-abiding citizens and businesses should not become inured to living under the constant threat of such attacks — or be forced to write off the resulting extortion payments and losses — simply as a cost of doing business and of living in a free society. Yes, they can take precautions to guard against becoming victims, and they should do so. But more must be done internationally to stop cybercriminal enterprises and collectively in this country to develop effective countermeasures.

It seems as though today's cybercriminals believe they operate above the law and outside the reach of any consequences for their illicit actions, and for now, they're probably right.

We lack the expertise to suggest how that situation might best change — but we hope someone with the power to do so will feel motivated to act.