Anderson Economic Group estimated dealership losses from the CDK outage at more than $1bn. Separately, chain analysis identified roughly 387 bitcoin — about $25m at the time — moving to an address associated with BlackSuit affiliates on 21 June, with reporting attributing the payment to CDK.
Three Ledgers, Three Different Parties
The ransom was paid by the supplier. The lost margin was borne by fifteen thousand independent businesses that had no say in the decision, no visibility of the negotiation and no contractual route to recover it.
And the customer whose purchase was delayed bore the inconvenience. The corpus keeps cost, demand and harm apart because they rarely reconcile; here they do not even land on the same balance sheet.
This Is The Funding Theme, Stated As An Arithmetic
The party that could have prevented the incident spent $25m. The parties that could not spent forty times that. Nothing in the arrangement transmits the second figure back to the first, which is precisely why the incentive to prevent is weaker than the loss would suggest.
The corpus recorded the same asymmetry at 25-0606 and across the supplier-compromise files. What CDK adds is a credible number on both sides of it in the same incident.
Both Figures Need Their Qualifications
The $1bn is a modelled estimate by an economic consultancy, not an audited total, and it depends on assumptions about lost sales that nobody can verify. The $25m is chain-traced and reported as very likely CDK’s; this desk has not seen the company confirm it.
Graded medium on both counts. The ratio is the finding, and it survives a good deal of error in either number.
Compiled from contemporaneous reporting, listed below. The $1bn figure is an estimate produced by an economic consultancy and is not an audited total. The ≈$25m payment is identified through blockchain analysis and attributed to CDK by reporting; this desk has not seen a company confirmation and does not treat the payment as confirmed. Graded medium. Corrections: corrections@forensicpost.com.