CDK Global supplies the dealer management system that roughly 15,000 dealerships in the United States and Canada use to sell and service vehicles. On 18 June 2024 it was hit by ransomware attributed to BlackSuit, and a second intrusion followed during recovery.
Dealerships processed sales, financing and service on paper for close to two weeks. Full restoration was reported around 4 July.
The Second Attack During Recovery Is The Detail To Keep
Recovery is the moment an organisation is least defended: systems are being rebuilt in a hurry, controls are relaxed to move faster, and the people who would notice something are working on something else.
This corpus has recorded intruders returning through access never fully revoked. Being hit again mid-restoration is the same failure at its worst moment.
The Fallback Existed, And It Was Terrible
A dealership can write a sale on paper. That is more than most sectors in this database can say, and it is why the industry did not simply stop.
But a modern vehicle sale involves financing approval, title and registration, a trade-in valuation, warranty registration and manufacturer reporting, and every one of those assumes the system. Paper preserved the transaction and lost the throughput.
The corpus filed at 25-0520 that six hundred applications went off and staff returned to pen and paper. This is the same finding at national scale: the fallback keeps the business alive at a fraction of its rate.
Compiled from contemporaneous reporting, listed below. The 15,000 dealership figure is the reported size of the affected customer base rather than a count of confirmed disruption. Attribution to BlackSuit is a research and reporting assessment; the company has not been seen by this desk to confirm it. Corrections: corrections@forensicpost.com.