CDK Global BlackSuit ransomware (2024)

On 18 June 2024, the dealer-management software giant CDK Global was hit by BlackSuit ransomware — and as CDK's platform went offline, roughly 15,000 North American car dealerships lost the systems they use to track inventory, run sales, process financing, and manage service bays. The result was the largest automotive-retail outage in U.S. history.

What happened

CDK runs the dealer-management system that mid-size and large North American dealers depend on for nearly every digital workflow. When BlackSuit's encryption fired, dealers reverted to paper and pen — handwritten contracts, manual inventory counts, calls between dealers to coordinate financing.

A second attack hit on 19 June, just as CDK began bringing systems up — an unusually aggressive double-tap by BlackSuit that extended the outage. CDK started restoration with smaller dealer groups on 22 June and projected full recovery by 4 July.

The attackers escalated their demand from $10 million to over $50 million. Multiple sources told CNN in mid-July that CDK ultimately paid approximately $25 million in ransom.

BlackSuit is a successor branch of the Royal ransomware operation, itself a re-skin of the older Conti crew — a lineage that has run continuously since the early 2020s under a series of brand names.

Impact

• ~15,000 North American dealerships offline for up to two weeks.
• Estimated collective dealer losses: over $1 billion (Anderson Economic Group).
• Reported $25 million ransom paid by CDK.
• One of the clearest cases yet of how SaaS concentration risk plays out in a single retail vertical.

Why it matters

When a dealer-management platform with this much market share goes offline, the entire vertical goes offline with it. CDK Global is the post-Change-Healthcare reference case for vertical SaaS concentration risk — and a reminder that the cybersecurity posture of a single software vendor can determine whether thousands of independent retailers can transact at all.