What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CDK Global has not publicly confirmed that it paid a $25 million ransom. However, blockchain researchers traced approximately 387 Bitcoin—worth about $25 million on June 21, 2024—to a wallet believed to be controlled by or associated with the BlackSuit ransomware operation. A separate source familiar with the matter reportedly confirmed an approximately $25 million payment.
The evidence strongly supports the reported payment, but it does not publicly prove that CDK itself sent the Bitcoin, identify any intermediary, or establish that the payment alone restored the company’s systems. Recovery continued in stages for days afterward.
As an Amazon Associate I earn from qualifying purchases.
What happened to CDK Global?
CDK Global, a major provider of dealership-management software, experienced two cyber incidents in June 2024. The company began investigating an incident on June 19 and shut down most systems as a precaution.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →CDK’s software supported approximately 15,000 dealership locations in the United States and Canada. Its systems helped dealers manage sales, financing paperwork, service scheduling, repair orders, parts, customer records, inventory, payroll and other back-office operations.
#1 Best Overall
Because so many dealerships depended on the same provider, the outage quickly became an industry-wide business-continuity problem. Some employees reverted to paper-based processes, while customers experienced longer waits for vehicle purchases, financing and repairs. CNN reported that wait times at some dealerships doubled or tripled. CyberScoop’s coverage described the scope of the disruption, while CNN’s reporting documented the effect on dealership operations.
What is the evidence for the $25 million payment?
The case rests on two main pieces of evidence.
1. The blockchain transaction
Researchers at TRM Labs identified approximately 387 Bitcoin transferred on June 21, 2024, to a wallet believed to be linked to BlackSuit or its affiliates. The Bitcoin was worth roughly $25 million at the time—not necessarily $25 million at any later date, because Bitcoin’s price changes continuously.
According to reporting by CyberScoop, the funds were later divided through a complex series of transactions. Approximately $15 million moved through nearly 200 transactions, with funds distributed across more than 20 addresses at five global exchanges. More than $6 million moved through additional addresses and exchanges, and at least one receiving address appeared connected to an active BlackSuit affiliate.
This kind of analysis can establish when cryptocurrency moved, how much moved and whether the receiving wallet resembles known criminal infrastructure. It cannot, by itself, prove who initiated the transaction. The payer could have been CDK, an insurer, a ransomware negotiator, a cryptocurrency broker or another intermediary acting on CDK’s behalf.
2. A source familiar with the matter
CyberScoop also reported that a separate source familiar with the matter confirmed that approximately $25 million was paid to a BlackSuit-linked wallet. That corroborates the blockchain evidence, but it remains an attributed source claim rather than a public admission or payment record released by CDK.
The timing is consistent with a ransom payment. The transfer reportedly occurred two days after the attack became public, on the same day Bloomberg reported that attackers were demanding tens of millions of dollars and that CDK planned to pay. Timing alone, however, does not establish the legal identity of the payer or the precise terms of the transaction.
Did CDK admit paying the ransom?
No. CDK and its parent company, Brookfield Business Partners, declined to answer questions about whether they or a representative paid the ransom, according to the reporting available at the time.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThat distinction matters. The most accurate description is that CDK reportedly paid approximately $25 million, or that CDK or someone acting on its behalf may have made an approximately $25 million payment to a BlackSuit-linked wallet. It is not accurate to say that CDK publicly confirmed the payment.
Reported timeline
| Date | What was reported |
|---|---|
| June 18, 2024 | The initial attack date commonly cited in subsequent coverage. |
| June 19, 2024 | CDK investigated a cyber incident and shut down most systems; a second incident was also reported. |
| June 21, 2024 | Approximately 387 Bitcoin, worth about $25 million at the time, moved to a BlackSuit-linked wallet, according to TRM Labs analysis. |
| Late June | Dealerships continued using manual procedures while CDK restored services in phases. |
| July 2, 2024 | CDK said substantially all dealer connections were live on its core dealer-management system. |
| July 12, 2024 | CyberScoop published its report on the blockchain analysis and apparent ransom payment. |
This is a reported timeline, not a complete incident log independently confirmed in every detail by CDK.
Did the ransom payment speed up recovery?
The payment was reportedly made to expedite recovery, but the available evidence cannot determine exactly how much time it saved.
A ransom payment does not automatically return a complex software environment to normal. Even if attackers provide a working decryptor, the victim may still need to:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- investigate how the attackers entered and whether they retained access;
- rebuild or validate affected infrastructure;
- rotate passwords, credentials, encryption keys and access tokens;
- check systems for persistence or malicious tools;
- test data integrity and application dependencies;
- reconnect customers and third-party integrations in stages; and
- monitor restored systems for additional compromise.
CDK’s services returned gradually rather than instantly. CRN reported that restoration continued in phases and that substantially all core dealer-management connections were live by July 2. The gap between the reported June 21 payment and the later restoration shows why paying a ransom is not the same as recovering an operating environment.
Rank #3
The payment may have helped negotiations, provided a decryptor or assisted the recovery process. Those are reasonable possibilities, not publicly established facts about CDK’s specific transaction.
Who was believed to be behind the attack?
Reporting attributed the attack to BlackSuit, a ransomware group that researchers have associated with the earlier Royal ransomware operation and broader Russian-speaking cybercrime activity.
The attribution should remain qualified. BlackSuit was believed to be responsible, and the payment wallet was linked by researchers to BlackSuit-related infrastructure. A wallet connection is not the same as a complete forensic attribution published by CDK or law enforcement. Early coverage also noted that BlackSuit had not publicly listed CDK on its leak site at that point.
Why the outage mattered to dealerships
The incident exposed the concentration risk created when thousands of businesses rely on one software provider for core operations. Dealers affected by the outage had to improvise workflows for:
- vehicle sales and financing;
- customer and inventory records;
- service appointments and repair orders;
- parts tracking;
- payroll and administrative work; and
- communications with customers and lenders.
At least six major public dealership companies—Lithia Motors, Group 1 Automotive, Penske Automotive Group, Sonic Automotive, Asbury Automotive Group and AutoNation—told the SEC that the incident affected their operations, according to CyberScoop.
Those disclosures do not support one universal dollar-loss estimate. The financial effect varied according to each company’s dependence on CDK, backup systems, geography, manual procedures and ability to use alternative tools.
Why Brookfield’s “not material” statement is not contradictory
Brookfield Business Partners said in a July 3 release that it did not expect the incident to have a material impact on its business, according to CyberScoop. That statement should not be read as meaning the outage was minor for dealerships.
“Material” is a financial and regulatory concept. It generally concerns whether an event could reasonably influence an investor’s decision or significantly affect a company’s overall financial position. An incident can be operationally severe for customers while remaining below a parent company’s disclosure threshold.
The same distinction applies to public dealership groups. A disruption can cause delays, lost productivity and customer dissatisfaction without producing a separately reported loss large enough to be material under securities-disclosure standards. Materiality depends on the company’s circumstances, the duration and scale of the effect, insurance coverage, financial results and other factors.
CyberScoop’s analysis of the disclosure issue is available here.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the incident says about ransom payments
Companies facing a prolonged outage may weigh lost revenue, customer disruption, restoration costs, stolen-data extortion, insurance coverage, the quality of backups and the likelihood that attackers will provide usable tools. They must also consider sanctions and compliance risks, particularly when a recipient is linked to a sanctioned entity or jurisdiction.
No source in the supplied reporting establishes that CDK violated sanctions or any other law. A payment to a wallet associated with a criminal group can nevertheless create significant legal and compliance questions that require specialized advice.
Best Value
Payment also creates strategic risks:
- Attackers may not provide a working or complete decryptor.
- Stolen data may still be retained or published.
- The attacker may have left behind access to the network.
- Payment can encourage repeat attacks against the same company or industry.
- A payment does not eliminate the need for rebuilding, validation and monitoring.
The broader business lesson: resilience beyond the ransom
The CDK incident was not only a question of whether $25 million changed hands. It demonstrated how a single software provider can become critical infrastructure for an entire commercial sector.
Dealership operators reviewing their exposure should examine whether they have:
- Independent backups: Backups should be protected from production credentials and tested through realistic restoration exercises.
- Manual operating procedures: Staff should know how to handle sales, service, payments, customer communications and payroll during a system outage.
- Alternative communication channels: Critical contacts and procedures should not exist only inside the unavailable platform.
- Incident-response support: Legal, forensic and technical contacts should be identified before an emergency.
- Vendor recovery commitments: Contracts should address recovery-time objectives, data portability, incident notification and customer access to records.
- Cyber-insurance terms: Coverage should be reviewed for business interruption, ransomware exclusions, waiting periods, sublimits, insurer consent and required security controls.
No endpoint-security, backup or insurance product can guarantee uninterrupted dealership operations when a critical SaaS provider goes offline. Resilience depends on the combination of technology, contracts, procedures and tested decision-making.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bottom line
The strongest evidence indicates that approximately 387 Bitcoin—worth about $25 million on June 21, 2024—was sent to a BlackSuit-linked wallet after the CDK attack. A separate source reportedly confirmed an approximately $25 million payment.
But CDK did not publicly confirm that it paid the ransom, and blockchain evidence alone cannot prove who sent the funds. The payment may have been intended to accelerate recovery, yet services were restored in stages and the outage continued afterward. The incident therefore supports two conclusions: the ransom payment is strongly indicated, but it was not a substitute for the difficult work of securing, rebuilding and validating a large shared software environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
