A cyber attack on blockwave Exchangesoftware provider CDK Global upended operations at car dealerships across the U.S. on Wednesday.

CDK spokesperson Lisa Finney said the company shut down most of its systems “out of an abundance of caution" for customers. By Wednesday afternoon, the company had restored its core document management system and digital retailing solutions.

"We are continuing to conduct extensive tests on all other applications, and we will provide updates as we bring those applications back online," Finney said in an emailed statement.

Finney did not respond to questions on how many dealerships were impacted, but CDK’s website says the company works with more than 15,000 retail locations across North America.

What does CDK Global do?

One of the leading providers of cloud-based software to dealerships in the country, CDK's software helps dealerships manage vehicle acquisitions, sales, financing, insuring, repairs and maintenance. The company's website says it offers a “three-tiered cybersecurity strategy to prevent, protect and respond to cyberattacks.” 

Why are car dealerships targeted by cyber attacks?

The incident follows a cyber attack against Findlay Automotive Group last week. The automotive group – which operates in five states – said the attack restricted its ability to conduct sales and service, according to reporting from the Las Vegas Review-Journal.

A 2023 report from CDK notes that cybercriminals are a growing threat to target car dealerships, with 17% of 175 surveyed dealers experiencing a cyber attack or incident within the past year, up from 15% the year prior. Of those dealers, 46% said the cyberattack had a negative financial or operational impact.

Dealerships have been an attractive target because of the vast amounts of sensitive customer data they hold. From credit applications to customer financial information, dealerships hold a "treasure of information" to hackers, according to a 2023 article from insurance company Zurich North America.

"In addition, dealership systems are often interconnected to external interfaces and portals, such as external service providers," the report reads. And many dealerships "lack basic cyber security protections."