CDK cyberattack expected to cost car dealers more than $1 billion, Michigan study says

The nation’s car dealerships experienced total losses of more than $1 billion as the result of a nationwide hacking and ransomware attack on their software and systems last month, according to a new estimate from East Lansing-based consulting firm Anderson Economic Group.

A cyberattack on Chicago-based dealership software provider CDK Global that began June 19 forced CDK to shut down most of its systems across the country for its dealership customers until July 5. It left about half of the nation’s car dealerships struggling to operate, forcing some to return to the days of pen-and-paper. According to Bloomberg, the group that orchestrated the attack demanded tens of millions of dollars in ransom to end it.

The result of the attack led J.D. Power and GlobalData to forecast late last month that U.S. retail sales in June across all automakers will be about 5.4 percent lower than they were in June 2023.

Based on June sales results, Anderson Economic Group on Monday issued a revised estimate to its June 28 estimate, which was a prediction that dealers would experience $944 million in losses. The group now estimates that total direct losses to car dealers in the three calendar weeks of the cyberattack actually reached $1.02 billion.

Anderson Economic Group has previously estimated losses from major events such as the 2023 UAW targeted strike against the Detroit Three.

Some sales losses can be made up later, some not

The $1.02 billion in losses includes revenue from the nearly 56,200 new car sales that Anderson Economic Group estimated were lost during the three-week period. It also factors in lost earnings on parts and service, additional staffing and IT service costs, and additional floor plan interest costs on inventory that could not be sold. The estimate does not include damages to consumers, reputational damages to dealers, litigation costs and multiple other categories of damages, said Patrick Anderson, CEO of the group.

“The revision is based on actual June auto sales and the actual duration of the outage, as well as corroborating information from investor disclosures from publicly traded auto dealer groups,” Anderson wrote in an email to the Free Press.

Anderson said the 56,200 new auto sales losses it estimated are much less than the actual sales drop that occurred in June and those anticipated for the first week in July. That’s because the group presumes that, “the large majority of people that signed a contract or made a commitment to buy a new car will, in fact, buy that car or a similar one from the same dealer,” Anderson said.

But some customers who will go to another dealer or postpone indefinitely, he said, and that is where the new sales losses arise.

“This episode is a wake-up call for the auto industry, and a warning to all others,” Anderson said. “Businesses that rely upon automated systems and centralized software — which means nearly all businesses — are vulnerable tohacking of systems managed by outside providers, and the losses caused by an outage can escalate quickly.”

The impact on Michigan unknown

Anderson said the group did not break out the impact specifically for car dealers in Michigan or other states because the effects of the hacking vary. Though half of the nation’s dealers rely on CDK systems, the geography of users was not sorted out. But he said the publicly traded auto dealership groups that have acknowledged they have been affected include Group 1 Automotive, Lithia Motors, AutoNation, Sonic Automotive and Asbury Automotive Group.

“All of these have disclosures to investors acknowledging the losses,” Anderson said. “Penske, a Michigan company (although I can’t confirm the corporate domicile), stated their passenger vehicle dealers were not affected, but their truck operations were. We did not include truck dealerships in our estimate.”

“We’ve been working very closely with Stellantis leadership to better serve our customers by providing the mix of products they desire and at competitive pricing,” Farrish said. “It’s been a very open, collaborative effort working together as a team, and we’ll continue to tackle these important issues together on behalf of our customers.”

Ford Motor reported an increase of 0.8 of a percent in its second quarter U.S. sales to 536,050 compared with the year-ago period. For the first six months of 2024, Ford reported 3.6 percent growth in sales to 1.04 million new vehicles sold.

Anderson said the estimate included used-vehicle sales, and new and used car leases. It also included in its estimate all parts and services work, including both warranty and nonwarranty. But it did not include any body shop work or collision-damage repair covered by auto insurance because sometimes that work is run by an auto dealership and other times it is outsourced, he said.

Impact of attack on the Detroit Three

Earlier this month, for the second quarter, General Motors reported a gain of 0.6 of a percent to 696,086 vehicles sold. For the first half of 2024, GM reported its U.S. new vehicle sales declined 0.4 of a percent to 1,290,319 million new vehicles sold. GM spokesman David Caldwell said last month that GM could not yet quantify the impact of CDK attack on its sales.

“Our dealers who use the CDK platform are working to meet strong customer demand under difficult circumstances,” Caldwell said. “Some deliveries may be delayed until Q3.”

Stellantis said it had U.S. sales of 344,993 in the second quarter, down 21 percent compared with the same period a year ago. The automaker did not reference the cyberattack in its news release, but the release did quote Kevin Farrish, National Dealer Council chairman for Stellantis, related to a range of issues.

Some sales losses can be made up later, some not

The impact on Michigan unknown

Impact of attack on the Detroit Three

Contact Us

Social Media

Links