More customers, including dealership employee, sue CDK

Ten customers from Arkansas, Michigan, Oklahoma and Texas who bought vehicles from CDK Global dealerships joined together to sue the software provider following its June 19 cyberattacks.

Their June 27 complaint in the U.S. Northern District of Illinois joins other federal consumer lawsuits against the dealership management system company. It too seeks class-action status, in this case defining the class as anyone whose information "was actually or potentially accessed or acquired" during the recent CDK incident.

Another consumer, Coby Hester, sued CDK in the Illinois federal court the same day, alleging in a separate case that his compromised information included personal data he provided for his job at a Houston dealership that used CDK and when he purchased vehicles from the store.

CDK did not respond to a July 1 email request for comment on the two cases.

CDK suffered at least two cyberattacks June 19 in what it called a "cyber ransom event." The dealership management system provider took its software offline as a precaution, forcing dealerships to find alternative ways to do business. On June 26, CDK said it had restored service to a test group of retailers and brought others — including Group 1 Automotive — back online. Full DMS restoration to all users is expected either July 3 or July 4.

"Plaintiffs' Private Information may have been involved in the Data Breach because the dealerships they purchased vehicles from have been affected by the Data Breach as they are CDK's clients," according to the lawsuit by Hans Stiritz of Russellville, Ark.; John Stiritz of Little Rock, Ark.; William Stiritz of Beebe, Ark.; Tom Kallas of Milford Charter Township, Mich.; Cassandra Gilleylen-Bowens of Flint, Mich.; Megan Zumbach of Sylvan Lake, Mich.; Adrian Aguilar of Vinita, Okla.; Dorie Leland of Lawton, Okla.; Bill Mussey of Helotes, Texas; and Marilyn Whitehead of Sachse, Texas.

Those 10 consumers accuse CDK of negligence, negligence per se, breach of implied contract, breach of fiduciary duty and unjust enrichment. They also seek a declaratory judgment from the court ruling CDK's security was insufficient for its duties of care and contractual obligations and ordering the DMS company take at least six security precautions.

The other lawsuit by Hester, an employee of Northwest Chrysler Jeep Dodge Ram, followed other federal lawsuits by one current and one former employee of CDK dealerships. A third case brought by dealerships and consumers also sought to add dealership workers as other plaintiff classes.

Hester said Northwest Chrysler required him to give CDK private information "directly or indirectly" both as a condition of employment and as part of his vehicle purchases from the store.

"Upon information and belief, at the time of the Data Breach, Defendant retained Plaintiff's Private Information in its system," his lawsuit stated.

Hester seeks to have his case serve on behalf of a class spanning anyone in the U.S. whose information had been compromised in the CDK incident.

He accuses CDK of negligence and negligence per se, breach of third-party beneficiary contract, unjust enrichment and breach of fiduciary duty.