CDK Global attack (2024)
Ransomware that paralyzed in June 2024 the management software used by some 15,000 North American car dealerships, a textbook case of accumulation through a single software provider.
CDK Global provides much of North America's car dealerships with their online management software: sales, financing, registrations, service, parts, payroll. On 19 June 2024, a ransomware attack forced the vendor to shut down its systems. For nearly two weeks, some 15,000 dealerships went back to paper and spreadsheets: sales slowed, financing files piled up, service departments struggled to order parts. The press reported that a ransom of tens of millions of dollars was paid; independent estimates put dealers' losses at about a billion dollars. No dealership had been attacked directly. For cyber insurance, the event demonstrated accumulation through online software. Thousands of insureds in the same sector suffer the same interruption at the same time, and their compensation depends on a single cover: dependent business interruption from a provider, often sublimited, sometimes excluded. It led underwriters to ask insureds for their list of critical software providers, and to model their portfolio's concentration on a few dominant vendors in a sector, as they did for the large cloud hosts.
In the days after the June 19, 2024 attack, several listed US dealership groups, including AutoNation, Lithia Motors and Group 1 Automotive, disclosed the incident to the SEC. A single software vendor thus produced simultaneous disclosures at competing companies, none of which had itself been attacked.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.