CDK Global’s warning concerned a June 2024 cyber incident—not an outage still continuing in 2026. As CDK shut down most of its dealer-management systems after incidents reported on June 18 and June 19, the company said impostors were posing as CDK representatives or affiliates and seeking passwords, sensitive information or access to dealership systems. CDK told customers that its employees would not solicit customer passwords or system access.
What happened to CDK Global?
CDK provides software-as-a-service dealer-management systems used by automotive dealerships. Depending on the dealership and its integrations, those systems support sales and financing, service scheduling and repair workflows, inventory, customer relationship management, accounting, payroll and other back-office work. They also connect with manufacturers, lenders, payment providers and other vendors.
CDK said it experienced an initial cyber incident on or around June 18, 2024, followed by an additional incident late on June 19. It then proactively shut down most systems. A contemporary report described CDK as serving approximately 15,000 dealerships, but that figure does not mean every dealership experienced the same outage or lost every function.
CDK’s customer warning and the contemporaneous outage report are documented by CRN.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Incident timeline and restoration
| Date or period | What was reported |
|---|---|
| June 18, 2024 | CDK reported an initial cyber incident. |
| Late June 19, 2024 | CDK reported an additional incident and shut down most systems. |
| June 20–21 | Dealership disruption continued, while CDK warned about impersonators and attempted access theft. |
| June 26 | Group 1 Automotive said its core CDK dealer-management service had been restored, with modified procedures (SEC filing). |
| June 29 | AutoNation reported restored access to its DMS and core functions; ancillary systems and integrations took longer (SEC filing). |
| July 2024 | Sonic Automotive reported continuing disruption in some lead, inventory and third-party integration functions after core access returned (SEC update). |
These filings show why there is no single restoration date for every dealership: core systems, ancillary applications and integrations came back in stages.
Why the outage affected dealership operations
A dealer-management system is not merely a sales screen. When it is unavailable, staff may lose access to records and workflows needed across the business.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Sales and financing: transactions, customer records and financing paperwork may require manual handling.
- Service: intake, scheduling, repair histories, estimates and approvals can slow down.
- Inventory: vehicle status, ordering and reporting may be incomplete or delayed.
- CRM and leads: customer inquiries and follow-up workflows may not flow normally.
- Accounting and back office: postings, reporting, payroll-related work and reconciliations can be delayed.
- Integrations: manufacturer, lender, payment, scheduling and other connected services may fail even after core DMS access returns.
Dealership groups did not describe a uniform shutdown. Sonic said its locations remained open while using workarounds (SEC filing). Group 1, Sonic and Asbury also described contingency procedures or continued operations, although processes were slower or limited in particular areas. Asbury’s account is in its SEC-filed release. A location could therefore remain open while being unable to complete a specific sale, repair workflow or data lookup normally.
What the phishing and impersonation warning meant
CDK said people were contacting customers and partners while posing as CDK members or affiliates. The reported objective was to obtain passwords, sensitive information or access to dealership environments. The company’s practical rule was unambiguous: CDK associates would not ask customers for passwords or solicit access to customer systems.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The available reporting supports phone-based impersonation and social engineering. It does not establish that every attempt was an email, used a particular domain or contained a malicious attachment, so “social engineering” is the safer general description.
Why an outage makes impersonation more convincing
This risk follows a predictable pattern, without proving that every suspicious contact came from the original intruders:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Employees expect urgent messages about restoration and workarounds.
- Normal portals, integrations and support routines are unavailable.
- Staff need technical instructions quickly to keep sales and service moving.
- A caller claiming to be a CDK technician can exploit that urgency.
- Normal verification standards may be relaxed because the business is already disrupted.
A fraudster might claim to need a password reset, request an MFA code, send a lookalike login page, offer remote-control software or ask for a payment-detail change. Those are potential attack patterns, not findings that each tactic occurred in this incident.
What dealership employees should do
During a suspicious call or message
- Do not provide passwords, MFA codes, recovery codes or approval for remote access.
- Do not install software, share a screen, click an unexpected link or open an unsolicited attachment.
- End the exchange rather than allowing the caller to create artificial urgency.
- Verify the request through a known-good channel already held by the dealership.
- Report the contact to the dealership’s IT, security or management team.
- Preserve the caller ID, phone number, email headers, screenshots, message text, URLs and timestamps.
If information or access was already disclosed
- Notify security immediately and reset affected credentials through a trusted channel.
- Revoke active sessions, review registered MFA devices and check for mailbox or endpoint changes.
- If remote access was granted, disconnect the device from the network and request forensic review.
- If financial or personal information was exposed, follow the dealership’s incident-response and legal-notification procedures.
How to verify a genuine CDK communication
- Use the dealership’s pre-existing vendor-contact directory, not a number or link supplied in the message.
- Ask an internal IT or security lead to validate the request.
- Confirm through an independently accessed CDK support or customer portal.
- Require two-person approval for privileged access, password resets and emergency configuration changes.
- Treat requests for credentials, MFA codes, remote-control tools or urgent payment changes as high risk.
- Never rely solely on caller ID, an email display name or a logo.
There is no universal CDK phone number reproduced here because the available warning does not establish a current safe number for every dealership. Each organization should maintain and independently verify its own contact list.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBest Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What was confirmed—and what remains unproven
Confirmed by CDK or public filings
- Cyber incidents occurred in June 2024, followed by a proactive shutdown of most systems.
- CDK warned about impersonators seeking passwords, sensitive information or system access.
- Dealer-management functions including sales, service, inventory, CRM and accounting were disrupted for affected operators.
- Dealership groups used manual or alternate procedures, and restoration occurred in stages.
Claims requiring attribution or caution
- Canada’s National Cyber Threat Assessment 2025–2026 later characterized the event as a ransomware attack affecting thousands of dealerships in the United States and Canada, with disruption lasting up to two weeks for some operations. That is a government characterization, not a complete technical disclosure by CDK (Canadian Centre for Cyber Security).
- The available material does not establish the attacker’s identity, a ransom payment, the precise intrusion method or that dealership or customer data was stolen.
- “Approximately 15,000 dealerships” describes CDK’s reported customer base; it does not mean all were equally offline.
The broader security lesson
The incident illustrates third-party concentration risk. A dominant service provider can create correlated operational exposure across many businesses, while the resulting urgency gives impersonators a credible pretext. Dealerships can reduce that exposure by combining phishing-resistant MFA for privileged accounts, unique passwords in a managed password vault, email and impersonation controls, out-of-band vendor verification, segmented third-party connections, centralized logging and tested manual-continuity procedures. No single product replaces those controls.
Status clarification
The outage and phishing warning described here belong to June 2024. They should not be read as a report that the same CDK outage remained active on August 18, 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
