AutoCanada’s public record describes three separate events—not one continuous attack: a June–July 2024 outage at third-party provider CDK Global, an internal IT incident AutoCanada disclosed in August 2024, and a separate incident window the company described in a March 2025 FAQ. The FAQ says a cybercriminal accessed some AutoCanada systems from February 28 to March 8, 2025, stole data, and some of it was later posted on the dark web. AutoCanada says the affected data may include personal, financial, insurance, registration, employment, payroll, health, and benefits information, but it could not reliably identify the exact data elements tied to each person.
What happened in the AutoCanada cyberattack?
AutoCanada’s March 2025 FAQ says a cybercriminal accessed some of the company’s systems between February 28 and March 8, 2025, and stole data. The company says some stolen data was later posted on the dark web. It has not publicly established that this incident was connected to the internal IT incident it disclosed in August 2024.
The events matter because they involved different systems and had different confirmed effects. AutoCanada’s June 2024 statement concerned an attack on CDK Global, a third-party provider whose software AutoCanada dealerships used. The August 2024 disclosure concerned an incident affecting AutoCanada’s internal IT systems; at the time, the company said it did not know the scope or whether data had been accessed. The March 2025 FAQ later described data theft during a separate February–March 2025 incident window.
| Date | System or provider | What AutoCanada said happened | What remained unknown |
|---|---|---|---|
| June 19–July 1, 2024 | CDK Global systems supporting dealership operations | CDK’s cyber incident disrupted AutoCanada’s dealer-management system. Dealerships stayed open using manual and alternative processes. AutoCanada reported business effects in its Q2 results. | On June 24, AutoCanada said it was still assessing the full impact and any customer or vendor data held by CDK. It said it had not identified compromise or unauthorized access to its own systems at that point. |
| August 11–13, 2024 | AutoCanada internal IT systems | The company identified an incident affecting internal systems on August 11 and disclosed it on August 13. | At disclosure, the investigation was ongoing and AutoCanada said it did not yet know the full scope or whether customer, supplier, or employee data had been accessed. |
| February 28–March 8, 2025 | Some AutoCanada systems | AutoCanada’s March 2025 FAQ says a cybercriminal accessed systems, stole data, and some data was later posted on the dark web. | The company says it cannot reliably determine the exact data elements belonging to each individual. Its public FAQ does not establish a link to the August 2024 incident. |
What personal information may have been exposed?
AutoCanada’s FAQ says the data may include customer personal and identity documents, financial information, and insurance or vehicle-registration records. For employees, it may include employment, payroll, health, or benefits documents. These are categories that may be involved, not a statement that every person had every type of information exposed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
The company says it cannot establish with certainty which exact records or data elements belonged to each individual because its analysis used deduplication and similarity-based matching. As a result, the public information does not let a reader determine precisely which items in their own file were taken. AutoCanada’s FAQ also says, “We have no proof that your data has been misused.” That is not confirmation that misuse is impossible; the company advises vigilance.
How did the CDK outage affect AutoCanada dealerships?
CDK’s June 2024 incident affected software used for dealership sales, service, inventory, business development, and accounting. AutoCanada said on June 24 that its dealerships remained open and continued selling and servicing vehicles through manual and alternative processes. The company later reported that the outage officially ended July 1, while restoration validation and cleanup continued through the end of July.
In its Q2 2024 results, AutoCanada reported revenue of $1,600.979 million for the three months ended June 30, down 8.8% year over year. It said the CDK outage and weaker performance in several operating areas contributed to the decline. Adjusted EBITDA was $26.970 million, down 71.3% year over year; the company attributed that decline primarily to lower gross profit and higher floorplan financing costs, among other factors, so it should not be read as the cost of the outage alone.
AutoCanada said the CDK disruption affected results through lost new- and used-vehicle sales and associated finance-and-insurance deals, lost service repair orders, and one-time incremental support costs. These are company-reported operating results, not an independent estimate of total cyberattack damages.
What did AutoCanada do after the data-theft incident?
According to its March 2025 FAQ, AutoCanada locked down systems, removed the third party’s access, engaged external experts, notified police and applicable privacy commissioners, reviewed records considered likely affected, and upgraded security controls. The public FAQ does not give a confirmed number of affected individuals or identify a specific threat actor.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if you may be affected?
If AutoCanada notified you
- Check the notice and the official AutoCanada FAQ for current instructions. The FAQ’s offer of two years of Equifax Canada identity-theft protection and credit monitoring had a November 30, 2025 enrolment deadline, which has passed; do not assume that historical offer remains available.
- Review bank, credit-card, and other financial accounts for transactions you do not recognize. Contact the relevant financial institution promptly if you see suspicious activity.
- Be cautious with unexpected emails, texts, or calls asking for personal information, account credentials, or payment. Do not use contact details or links in a suspicious message; independently verify the organization through its official channel.
If you think you may be affected but received no notice
AutoCanada’s FAQ directs people who believe they may be affected but were not notified to contact the company using the incident contact information on its official FAQ page. Check that page for the current phone number and hours before calling, since those details may change.
Quick Recap
Sources and incident records
- AutoCanada’s June 24, 2024 update on the CDK Global incident.
- AutoCanada’s August 13, 2024 announcement of an internal IT incident.
- AutoCanada’s FAQ about the incident described in March 2025.
- AutoCanada’s Q2 2024 results and financial reports.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
