Findlay Automotive via CDK Global: Supply Chain

CDK Global is a software-as-a-service platform that runs the sales, financing, parts, and service systems for roughly 15,000 dealerships across the United States and Canada, Findlay included. On June 18 and 19, 2024, CDK was hit by two waves of ransomware, widely reported to be the BlackSuit crew (an evolution of the Royal / Conti ransomware lineage). CDK took its systems offline to contain the attack and the entire dealer industry went dark with it.

For most of the next two weeks, Findlay's showrooms across the Las Vegas Valley operated on pen and paper. Salespeople wrote contracts by hand. Service writers tracked repair orders on legal pads. Parts looked up by phone and manufacturer book. Customers waited longer for everything.

According to Bloomberg, corroborated by blockchain analysis from TRM Labs, CDK paid approximately $25 million to BlackSuit to recover. Recovery of full functionality stretched into early July for many dealers.

Findlay's own systems were not the target in this incident. They were collateral damage through a shared vendor every dealership depends on. That is the supply-chain lesson: your security perimeter ends at the worst-defended company you rely on: your accounting platform, your payment processor, your scheduling app, your phone system. Pick one of those today and ask them: “what happens to us if you go offline for two weeks?”