CDK CEO Brian MacDonald works to move beyond cyberattacks

The night before June 19, Brian MacDonald attended a hockey game. The CDK Global CEO owns a home in Florida, and he capped his day driving two hours to see the Florida Panthers face off against the Edmonton Oilers in the National Hockey League's Stanley Cup Final.

MacDonald returned home around 2 a.m. and went to bed. A few hours later, CDK Chief Information Officer Warren Leggett called him with news that changed everything.

"Our team saw some anomalous activity on our network, shut [it] down and then very quickly we realized that we were attacked," MacDonald said.

A second attack followed later in the day, leading to a massive two-week shutdown of CDK's dealership management system for 15,000 customers across North America. MacDonald, in an Aug. 28 interview on the Automotive News "Daily Drive" podcast, reflected on the experience, touching on dealers' "heroic" efforts to keep their business running during the shutdown and steps CDK has taken to help customers. He also spoke of a desire to move past the attacks.

"I used to try to teach my kids that sometimes bad things happen to good people, and sometimes bad things happen to good companies," MacDonald said. "But it's how you recover and deal with it, right? And so during and after this event, what I said to our employees is, 'Look what happened. It's incredibly unfortunate for our dealers. It was a horrific event for them. It was a horrific event for our company. But I think we dealt with it as best as we could, and now it's about what we do going forward.' "

MacDonald said CDK is accelerating and increasing its investment in IT infrastructure and innovation, moves he said will lead to new product releases in the coming months. CDK has invested $500 million in technology and innovation since July 2022, when Brookfield Business Partners took the company private in an $8.7 billion deal.

CDK also waived the June bill for its DMS customers. MacDonald said there won't be further compensation.
"We gave our dealers one month credit, one month free effectively, and I think that speaks to the financial strength of CDK," MacDonald said. "Most of our competitors would not be in a financial position to literally give up a month of revenue."

Earlier in the summer, CDK said it would collectively handle the Federal Trade Commission Safeguards Rule if necessary, which requires car dealerships and other nonbanking financial institutions to notify the agency no more than 30 days after discovering a security breach where there was access to unencrypted information for at least 500 customers. CDK disclosed on Aug. 26 that dealership customer and employee data was not affected by the attacks.

Moving forward won't be a smooth process, said Judy Farcus Serra, COO of Headquarter Automotive, a CDK customer with stores in the Orlando and Miami areas.

"I think that many will be in my shoes. A watch-and-see in a year to three years will tell a lot," Serra said via email. "Many people are still in the beginning of long-term contracts so they have to be in wait-and-watch mode."

At the same time, Serra said the one-month credit, investment in technology and other moves CDK has made are positive developments.

"These are definitely things that will help them build back confidence," Serra said. But "there are other factors over the long term — increase the quality of support, including timely case resolutions, programming quality, making promises and then keeping them."

Serra said CDK still has "a significant amount of very knowledgeable customer-centric" employees the company can build upon moving forward.

"They need to invest in those people — get more of them — and perform at the standards one would expect when [customers] are paying a premium for service," Serra said.

Dannelle Walker, vice president of operations for CDK clients Laurel Ford-Lincoln and Kia of Laurel in Mississippi, said she appreciated how CDK employees worked to get the DMS back up and running. Walker said she was uncertain, however, about whether MacDonald and CDK were addressing the full impact of the attacks. For her, moving forward will involve careful deliberations.

"Like many dealers, we will take some time to think through options on how we move forward and whether we continue with CDK or move to another vendor," she said. "Everyone has to remember, though, that it could have happened to any company, so we're also doing our best to think it through and not make a super reactive decision."

Erik Nachbahr, CEO of cybersecurity firm Helion Technologies, said CDK should disclose more details about the attacks to restore trust and help dealerships move forward. CDK has declined to disclose the cause or the specific steps it has taken to reduce the risk of cyberattacks.

"While their claim that no customer data was compromised is reassuring, CDK should be more transparent about how the attack occurred," Nachbahr said. "Greater openness regarding the nature of the attack, the systems that were affected and the steps taken to restore them would help restore trust."

At the same time, openness in an age of massive cybersecurity attacks may only go so far by necessity. Nachbahr said organizations "generally avoid sharing specific cybersecurity measures, as this could inadvertently assist cybercriminals."

Moving ahead won't be easy for dealerships, in general, even though there was no theft of personal data, said Andrea Amico, CEO of Privacy4Cars in Georgia. Privacy4Cars produces software that helps dealerships delete personal information from used vehicles before they're sold. That's because dealerships are now operating under a different dynamic, he said.

"It would be naive to assume dealers aren't facing a 'new normal,' " Amico said.

"Cyber insurance is harder, more expensive, yet more necessary to get. Regulators are asking tough questions to manufacturers and scrutinizing dealers. Consumers in showrooms are regularly making buying decisions based on the reassurances — or concerning lack of factual answers and evidence — about how their data is handled."

MacDonald said CDK rank and file went into overdrive trying to bring things back online after the cyberattacks, even as dealerships turned to pen and paper and third-party software workarounds to keep operations temporarily functioning without it.

"We had employees sleeping on the floor in our offices to get the dealers back up and running. And, you know, we had to send people home in Ubers to get sleep and rest," MacDonald said. "We all have, including myself, a tremendous amount of empathy for what dealers went through and to see up close and personal the heroics that dealership employees did … making their business work so that until such time that we could get them up and running."

He would not disclose specifics but said CDK incurred considerable financial expense to manage the attacks and facilitate a successful recovery.

"At CDK, we rallied outside advisers and our own internal folks. We literally had hundreds of external people working to get our systems back up and running safely and securely," MacDonald said. "That comes with a cost. A lot of cost."

At the same time, MacDonald said he was never worried about CDK's survival.

"There's a substantial financial cost of this to CDK, and obviously to our dealers as well," he said. "Fortunately, CDK is a very strong company … we have a strong business [and] strong business model."

MacDonald said CDK is offering a free cybersecurity training tool for the year to the industry. He also has two key tips to help reduce risk.

"Educate your employees," he said, "and be ever vigilant."

Jamie Butters contributed to this report.