Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversFall ResetAmazon USFall reset deals: check better picks before checkoutAmazon US: today's deals, useful picks and quick comparisons.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
Blog

CDK Attack Shows Why SaaS Contingency Planning Matters

By TheFinanceBase Team8 min read
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

The June 19, 2024, CDK Global cyber incident showed that cloud availability is not the same as operational resilience. Dealerships did not necessarily lose their own servers, but many lost access to systems supporting sales, financing, service, inventory, customer relationships, accounting, payments, scheduling, and reporting. Some remained open only by using manual workarounds while restoration proceeded in stages.

The practical lesson applies beyond auto retail: any business that depends on a software-as-a-service (SaaS) provider needs a plan for continuing critical work when that provider is unavailable, compromised, corrupted, or no longer trustworthy.

What the CDK outage exposed

CDK Global notified customers of unauthorized cyber activity on June 19, 2024. Public-company filings describe CDK as a critical third-party SaaS platform embedded in dealership operations. Group 1 Automotive described dependencies spanning customer relationships, vehicle sales and financing, service, inventory, and back-office operations, while other filings documented the use of alternative processes and workarounds.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The incident was not a simple loss of files or email. A dealership-management system can connect multiple departments and external services, including:

#1 Best Overall
Sale
UGREEN NAS DH2300 2-Bay for Beginners & Personal Users, Phone Backup
  • Entry-level NAS Personal Storage:UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
  • Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
  • The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
  • Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
  • Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
  • customer relationship management and sales pipelines;
  • vehicle inventory, appraisals, pricing, and deal documentation;
  • financing and lender workflows;
  • service appointments, repair orders, technician notes, and warranty processes;
  • parts ordering, pricing, and supplier information;
  • accounting, payment, payroll, and reporting functions; and
  • registration, title, manufacturer, and other integrations.

AutoNation reported that core access was restored by June 29, although some ancillary systems and integrations returned later. CDK and Brookfield said substantially all customers were back on the core dealer-management system by July 3. Sonic Automotive said its dealerships remained open using workarounds. “Open,” however, did not mean unaffected or fully productive.

The precise attack mechanics and threat-actor attribution were not fully established by the primary disclosures. Claims about ransomware families, ransom payments, or named groups should therefore be treated as reported or alleged unless confirmed by a primary source. Relevant company filings include AutoNation, Group 1 Automotive, Sonic Automotive, and CDK’s restoration update.

SaaS availability is not SaaS resilience

These concepts are related but different:

  • Business continuity asks whether people can keep performing critical work during an interruption.
  • Disaster recovery focuses on restoring systems and data.
  • Incident response addresses containment, investigation, evidence preservation, and safe recovery after a security event.
  • Vendor-risk management addresses concentration risk, contracts, controls, dependencies, and exit options.
  • Backup preserves recoverable data, but does not necessarily provide a functioning replacement application.

NIST describes contingency planning as a coordinated strategy involving plans, procedures, and technical measures for recovering systems, operations, and data. Its guidance recognizes alternate processing through manual means, alternate equipment, alternate locations, and external recovery arrangements. The key question is not merely whether a provider can eventually restore its platform. It is whether the customer can preserve essential operations safely while restoration is uncertain.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
UGREEN NAS DXP2800 2-Bay for Advanced Home Users, Remote Workers & Creators
  • 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
  • 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
  • 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
  • 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
  • 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.

A backup may not include live integrations, permissions, workflows, forms, audit trails, payment processing, or the trained knowledge needed to operate another system. That is why SaaS resilience must cover people, processes, data, applications, integrations, communications, contracts, and testing.

Map critical processes, not just applications

Start with a business-process inventory. For each process, record the applications involved, the maximum tolerable downtime, acceptable data loss, minimum information required, and approved fallback.

Business function Likely dependencies Fallback Maximum tolerable downtime
New-vehicle sales DMS, CRM, manufacturer and financing systems Paper deal jacket and approved offline forms Same day to 24 hours
Used-vehicle sales DMS, inventory, appraisal, and title tools Local inventory export and paper approvals About 24 hours
Service write-up DMS, appointments, repair-order platform Numbered paper repair orders Same day
Parts DMS, catalog, ordering, pricing integrations Printed price matrix and supplier contacts Same day
Accounting DMS, payment, payroll, and general-ledger integrations Controlled transaction log and spreadsheet 24–72 hours
Customer communications CRM, email, texting, and call-center tools Approved contact list and phone scripts Same day
Compliance and records DMS, document management, identity systems Secure forms and evidence log Obligation-specific

The fallback does not need to reproduce the entire SaaS platform. It must preserve the minimum viable operating function safely and lawfully until systems return. Requirements may vary by state, transaction type, manufacturer, lender, tax authority, and regulator, so legal and compliance teams should review manual procedures.

Rank #3
BUFFALO LinkStation 210 2TB 1-Bay NAS Network Attached Storage with HDD Hard Drives Included NAS Storage that Works as Home Cloud or Network Storage Device for Home
  • Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
  • Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
  • Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
  • Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
  • Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.

Build a usable emergency playbook

A continuity plan should be usable at 8 a.m. on a busy day, not merely stored in a policy folder. Keep a current copy outside the affected SaaS tenant and include:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • incident-declaration criteria and named decision-makers;
  • vendor, insurer, legal, and incident-response contacts;
  • an employee contact tree;
  • approved paper forms and controlled spreadsheets;
  • preprinted or locally stored customer and inventory extracts;
  • a unique numbering system for offline transactions;
  • rules for payments, deposits, refunds, discounts, financing, and vehicle release;
  • identity-verification, privacy, and retention instructions;
  • department coordinators and approval authorities;
  • customer communication scripts; and
  • a post-restoration reconciliation procedure.

Example emergency sequence

  1. Confirm the outage through an out-of-band channel. Do not rely solely on links or instructions inside a potentially compromised account.
  2. Follow incident-response instructions and isolate local systems when directed.
  3. Declare the appropriate continuity level.
  4. Switch to approved forms and offline records.
  5. Assign one coordinator per department.
  6. Log every transaction with a unique number.
  7. Require controlled approval for refunds, financing, discounts, and vehicle release.
  8. Communicate customer-impact information consistently without speculating about the incident.
  9. Resume normal processing only after the vendor confirms restoration and the organization validates the environment.
  10. Reconcile every offline transaction and update the plan based on the results.

Back up data and the operating context

Evaluate whether independent backups cover more than documents. Depending on the application, the protected set may include:

  • customer, vehicle, inventory, pricing, and appointment records;
  • open repair orders, parts orders, sales pipelines, and accounting exports;
  • emails, messages, attachments, and signed documents;
  • users, roles, permissions, and audit logs;
  • forms, templates, workflows, reports, custom fields, and configurations;
  • integration inventories and securely stored API credentials; and
  • the data needed to recreate operations in another system.

A vendor’s redundancy, recycle bin, retention feature, or disaster-recovery program is not automatically an independent customer-controlled backup. Ask how long data is retained, whether deletion is protected, how granular recovery is, whether configuration and attachments are included, whether exports are usable, and whether copies are isolated from the production tenant.

Rank #4
Synology DS225+ Private Cloud Media Server - Stream, Back Up Photos & Share Files, Intel CPU for Hardware Transcoding (2-Bay Diskless NAS)
  • Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
  • Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
  • Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
  • Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
  • Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring

CISA recommends offline, encrypted, regularly tested backups and highlights third-party risk, least privilege, and separation of duties. Local reference data can help operations continue, but it also creates privacy and theft risks. Store only the minimum necessary information, encrypt it, restrict access, set expiration rules, and securely destroy obsolete copies.

Ask better questions during vendor renewal

Resilience and recovery

  • What are the contractual recovery time objective (RTO) and recovery point objective (RPO)?
  • Are they binding commitments or estimates?
  • Do they apply separately to the core application, integrations, regions, tenants, and identity services?
  • How often are disaster-recovery tests performed, and will customers receive summaries or assurance reports?
  • Can customers use a read-only or degraded mode?
  • Can data be exported in a usable format during an outage?

Security and incident response

  • How are tenants isolated?
  • What privileged-access and multifactor-authentication controls apply?
  • How are support staff authenticated?
  • How quickly will customers be notified of a cyber incident?
  • What incident evidence and recovery information will be provided?
  • Can the customer revoke tokens or suspend integrations independently?
  • How are backups protected from deletion or encryption by an attacker?

Dependency and exit

  • Which functions are native and which rely on third parties?
  • Can the customer export configurations as well as data?
  • How long is data retained after termination?
  • Are there export, emergency-restore, or professional-service fees?
  • Is there an exit period for a prolonged outage?

Contracts should address uptime objectives, incident notification, RTO and RPO targets, backup retention, testing, subprocessors, security controls, assurance reports, data portability, transition assistance, and remedies for repeated or prolonged failures. Service credits are not the same as compensation for lost sales, inefficient labor, customer remediation, compliance work, and reputational harm.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What does not solve the problem

  • “The provider has backups.” Those backups may support the provider’s restoration but not independent customer operations.
  • “We have a PDF export.” A static file may help with reference and reconciliation but cannot process appointments, repair orders, payments, or inventory changes.
  • “We can switch to another DMS.” A substitute usually requires conversion, training, integrations, configuration, and testing. It is an exit strategy, not necessarily same-day failover.
  • “Spreadsheets are enough.” They can support short outages but create version-control, privacy, formula, access, malware, and reconciliation risks.
  • “A second SaaS provider creates redundancy.” The second provider may share the same identity system, cloud region, API, data source, or subcontractor.
  • “Cyber insurance covers everything.” Coverage varies. Review dependent business interruption, waiting periods, exclusions, forensic costs, restoration, notification, regulatory response, and required security controls.

Test the plan before an outage

Tabletop exercise

Use a realistic scenario: the primary DMS becomes unavailable at 8 a.m. on the last business day of the month. Test who declares the incident, who contacts the vendor, whether every department can find its forms, how open customer commitments are identified, how managers approve transactions, and how customers are notified.

Best Value
Synology 2-Bay DiskStation DS223j (Diskless)
  • Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
  • Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
  • Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
  • Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
  • 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates

Functional test

Run a limited exercise. Create a paper repair order, record parts and labor, simulate an approval, process a payment and refund under controlled conditions, produce an end-of-day report, and re-enter the transaction into a test environment. Measure errors and reconciliation time.

Technical recovery test

  • Restore a sample dataset into an isolated environment.
  • Verify attachments, metadata, permissions, and audit logs.
  • Test one-record and bulk recovery.
  • Confirm that exports are usable.
  • Test the restoration of integrations.
  • Validate that restored data is clean before reconnecting it.

Track time to declare continuity mode, time to retrieve forms and data, the percentage of critical processes with documented fallbacks, manual transaction volume, reconciliation errors, actual RTO and RPO, integration-restoration time, employee training coverage, and time to return to normal operations.

A layered SaaS-resilience model

  1. Prevent: Use multifactor authentication, least privilege, segmentation, secure integrations, and vendor-risk reviews.
  2. Detect: Monitor identity events, anomalous activity, vendor notices, and integration failures.
  3. Contain: Revoke tokens, isolate integrations, restrict privileged access, and preserve evidence.
  4. Continue: Activate manual procedures, alternate communications, local reference data, and emergency approvals.
  5. Recover: Restore clean data and configurations, validate the vendor environment, and reconnect integrations cautiously.
  6. Reconcile: Enter offline transactions, remove duplicates, verify deposits, inventory, accounting, and compliance records.
  7. Improve: Review the incident or exercise and revise procedures, contracts, training, and architecture.

Choosing backup and resilience services

SaaS backup can be valuable for dealership-adjacent systems, but it is not automatically a replacement for a dealer-management platform. For example, Microsoft 365 Backup protects Microsoft 365 content and lists pricing of $0.15 per GB per month on its official page. Veeam, Afi, Backupify, and Spanning offer different application coverage, recovery features, and pricing models. Prices and regional availability can change, so verify current terms directly with each provider.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

When comparing a service, ask whether it supports the exact application in use and protects attachments, metadata, permissions, audit logs, configurations, and integrations. Also check recovery granularity, isolated restoration, included storage, retention and egress fees, administrative separation, immutability, and demonstrated recovery testing. A Microsoft 365, Google Workspace, or Salesforce backup product should not be presented as CDK failover unless the vendor explicitly supports the relevant dealership platform.

In practice, the strongest approach is a resilience stack: independent data protection, protected offline exports, manual continuity procedures, incident-response exercises, vendor-contract and insurance review, and a documented migration or alternate-provider strategy.

Quick Recap

Bestseller No. 3
BUFFALO LinkStation 210 2TB 1-Bay NAS Network Attached Storage with HDD Hard Drives Included NAS Storage that Works as Home Cloud or Network Storage Device for Home
BUFFALO LinkStation 210 2TB 1-Bay NAS Network Attached Storage with HDD Hard Drives Included NAS Storage that Works as Home Cloud or Network Storage Device for Home
2TB capacity – 1 Drive bay, HDD included.; Made in Japan – Quality Devices.; 24/7 US-based support, with 2-year warranty, including hard drives.
$153.99
Bestseller No. 5
Synology 2-Bay DiskStation DS223j (Diskless)
Synology 2-Bay DiskStation DS223j (Diskless)
Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
$209.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Written by TheFinanceBase Team

The Team behind TheFinanceBase.

Add your note

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.