\n
![](\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2024\/06\/GettyImages-1945202627-e1719067867896.jpg?w=2048\")
<\/p>\n [ad_1]
\n<\/p>\n
A group that claims to have hacked CDK Global<\/a>, the software provider to thousands of car dealerships in North America, has demanded tens of millions of dollars in ransom, according to a person familiar with the matter.<\/p>\n CDK is planning to make the payment, said the person, who asked not to be identified because the information is private. The hacking group behind the attack is believed to be based in eastern Europe, the person said. In the early days of any ransomware attack, discussions are fluid, and the situation could change.\u00a0<\/p>\n CDK didn\u2019t respond to multiple requests for comment on Friday.\u00a0<\/p>\n Since CDK discovered the breach and shut off systems on\u00a0June 19<\/a>, chaos has ensued at many of the roughly 15,000 car dealerships that it counts as clients. CDK\u2019s core product \u2014 a suite of software tools referred to as a dealership management system, or DMS \u2014 underpins virtually every element of auto retailers\u2019 day-to-day business. So the outage hampered sales, interrupted repairs and delayed deliveries across an industry that topped\u00a0$1.2 trillion<\/a>\u00a0in US sales last year. The disruptions also are hitting amid an end-of-quarter sales push.<\/p>\n \u201cIt\u2019s just mass chaos at this point,\u201d Diana Lee, the chief executive officer of Constellation, a marketing agency that works with auto dealerships across the US, said on Bloomberg Television. \u201cThe dealer\u2019s required to actually run a DMS for sales, service, parts, for every single functionality \u2014 even stocking a vehicle, you can\u2019t do it without the DMS system. So it is a disaster.\u201d\u00a0<\/p>\n CDK had briefly restored some services for a few hours on June 19, but was forced to deactivate them following a second cyberattack. On Thursday, the company warned dealers that their systems likely will not be available for\u00a0several days<\/a>.<\/p>\n A demand in the tens of millions of dollars comes after hackers\u00a0sought $50 million<\/a>\u00a0from a lab services company at the center of an ongoing ransomware attack that\u2019s caused outages in London hospitals. UnitedHealth Group<\/a> Inc., the largest medical insurer in the US, acknowledged earlier this year\u00a0it paid hackers<\/a>\u00a0a $22 million extortion fee.<\/p>\n CDK hasn\u2019t said who or which entity is behind the intrusion, but it issued a warning to customers Thursday evening, saying that outside parties are reaching out to customers, attempting to capitalize on the confusion.<\/p>\n \u201cWe are aware that bad actors are contacting our customers, posing as members or affiliates of CDK, trying to obtain system access,\u201d the company said. \u201cCDK associates are not contacting customers for access to their environment or systems. Please only respond to known CDK employees and communications.\u201d<\/p>\n There are only a handful of DMS companies for dealers to choose from after decades of consolidation within this corner of the car-retailing industry. As a result, thousands of stores are highly reliant on CDK\u2019s services to line up financing and insurance, manage inventory of vehicles and parts, and complete sales and repairs.<\/p>\n The car dealer Sonic Automotive<\/a> Inc., which uses CDK to support critical dealership operations, said disruptions caused by the cyberattack are likely to have a \u201cnegative impact\u201d on its operations until its systems have recovered, according to a Friday filing. Sonic hasn\u2019t determined if the attack will have a material impact on its finances, and it has reopened all of its dealerships with workaround solutions to limit disruption, the company said.<\/p>\n CDK\u2019s parent, Brookfield<\/a> Business Partners LP, had its worst trading day since October \u2014 plunging 5.7% on Thursday \u2014 and extended its decline Friday. Shares in dealer groups AutoNation<\/a> Inc., Group 1 Automotive<\/a> Inc. and Sonic Automotive Inc. also slumped.<\/p>\n<\/div>\n\nSubscribe to the Fortune Next to Lead newsletter to get weekly strategies on how to make it to the corner office. Sign up for free<\/a> before it launches on June 24, 2024.<\/div>\n