Automakers tell DMS providers to expect security audits in wake of CDK cyberattack, executive says

Concerned by the CDK Global cyberattacks, some auto manufacturers are developing plans to audit all U.S. dealership management system providers to make sure their security protocols can help prevent future events, a DMS executive said.

Sharon Kitzman, president of Dominion DMS, told Automotive News on June 26 that she has heard from several car makers already.

“We’ve already been contacted by multiple manufacturers that we are already certified with, for their integrations for things like warranty, claims and parts ordering,” Kitzman said. “They're just letting us know that they will be auditing all of the DMS providers that they are certified with.”

She would not name the specific manufacturers but said they will be looking at security protocols to see if any are insufficient to fend off a cyberattack.

In a June 26 statement, Reynolds and Reynolds President Chris Walsh said the company so far has “not received any audit requests from any manufacturers. We have been continuously working with all our partners, including manufacturers, to help ensure we are doing all we can to keep our technology and customers secure,” Walsh said.

A Tekion spokeperson said the company has not been asked for an audit.

Cox Automotive, owner of Dealertrack DMS, did not address whether automakers have said they would audit their cybersecurity but released the following statement.

“We are in regular conversation with our OEM, dealer and lender clients about our security posture and what may be required to operate in a way that prioritizes the safety of their data and the continuity of their business operations,” Cox said. “Security at Cox Automotive is paramount and our approach is multi-layered across our entire enterprise. We are continually monitoring our networks and systems and take actions with our clients' security and business continuity at the forefront.”

Erik Nachbahr, president of cybersecurity services provider Helion Technology, said auditing DMS companies about their cybersecurity practices is a big step for manufacturers.

“This is a significant shift in the approach automakers are taking toward cybersecurity,” Nachbahr said. “A warning to pursue audits implies that automakers expect DMS providers to take full responsibility for their cybersecurity measures."

At the same time, the move to audit cybersecurity protocols across DMS providers may not have much practical value, Nachbahr said.

“I would rather see a push for the adoption of established cybersecurity standards,” Nachbahr said. “This could set clear expectations and requirements for security measures, ensuring a more uniform level of protection across the board.”

Meanwhile, CDK Global CEO Brian MacDonald is defending the company's response following two cyberattacks June 19, even as its recovery process confronts new challenges.

"Our executive leadership team is engaged with dealer group customers during daily small group discussions, emails and phone calls; and our sales and customer success teams are conducting one-to-one outreach with dealers in their territories to provide alternative ways to support their sales and service efforts in the interim," MacDonald said.

At the same time, the dealership management system company acknowledged in a June 25 note to its thousands of customers across North America that it won't be able to get all dealers live before June 30. News of a further delay threw a wrench into dealerships' month-end financial close process, and CDK encouraged customers to "make alternate plans."

With the second quarter coming to a close at the end of June, the indefinite shutdown – affecting more than 15,000 dealership customers in North America – could also affect new- and used-vehicle sales across the industry.

CDK also now has at least two lawsuits to contend with, and more are likely.

A dealership customer has filed a lawsuit seeking class-action status alleging the attacks compromised his personal information. Another suit, filed by a former auto retail employee, also seeks class-action status, alleging the breach exposed personal information "to unauthorized third parties." Both were filed in the U.S. Northern District of Illinois. CDK is headquartered in suburban Chicago and Austin.

The latest CDK update comes as a clearer picture has emerged of how much the cyberattacks are disrupting the largest U.S. auto dealership groups.

CDK has contracts with five of the six top public dealership groups — Group 1 Automotive Inc., Lithia Motors Inc., Asbury Automotive Group Inc., AutoNation Inc. and Sonic Automotive Inc. — and all of them have now issued statements or made regulatory filings disclosing slowdowns in business operations and steps taken to reduce their post-attack risks. The sixth company — Penske — contracts with CDK on truck operations and has taken similar protective steps.

So far, CDK dealership customers are pursuing business as usual with workarounds in place.

The BlackSuit hacking group, made up of Russian and Eastern European hackers, appears to have been behind the attacks, Bloomberg reported June 24. The group demanded CDK Global pay tens of millions of dollars in ransom to lift the DMS outage, Bloomberg reported June 21. CDK was planning to pay the ransom, the report said.

John Huetter contributed to this report.