Car dealers face scam attempts after outage linked to cyber attacks

TORONTO — An auto industry group warned dealers Monday to be on the lookout for scammers as outages continue after last week’s cyber attacks.

The alert comes as CDK Global, an Illinois-based company that provides software to several car dealers in Canada and the US, was hit by back-to-back cyber attacks on Wednesday that led to a widespread outage.

Within 24 hours of last week’s outage, said Tim Reuss, president of the Canadian Automobile Dealers Association, members reported attempts by scammers to steal their login credentials by impersonating company representatives.

“When this was happening,” Reuss said of the cyberattacks, “there were other scammers who talked to the dealers and posed as CDK representatives and said, ‘Hey, I’m here to help you.’

He said the scam attempts added insult to injury.

“Not only was the supplier hit, but there were other bad actors trying to take advantage of the whole situation,” Reuss said in an interview.

CDK told its customers to watch out for “bad actors” posing as CDK members or affiliates to try to gain system access by contacting customers. He urged them to be wary of any phishing attempts.

The dealer management system, which helps run day-to-day operations such as transactions and service appointments, remains critical to operations, Reuss said.

Dealerships remained open, but workers switched to pencil and paper to record information instead of the computer system.

Gerald Wood, president of the Alberta Motor Dealers Association, said dealers have found creative ways to do business.

“It’s a lot of pulling out old forms and hand writing things,” he said. “It’s a little back to basics.”

Many dealers prepare the sales invoice for their customers, which requires extra care for accuracy between dealers.

“Anytime you go from an electronic system to a manual system, there’s always some concern that the accuracy starts to slip a little bit,” Wood said.

Ford, Stellantis and BMW are among the auto companies affected by the outage. Stellantis Canada said in an email that dealers have resorted to manual processes as CDK continues to resolve the issue.

CDK said it will take at least a few more days to restore the system.

Once the system comes back on, Reuss said, there will be a “hangover” among dealers as they recover from the outages.

“It should be a matter of a few weeks before the dealer has to re-enter everything and reconcile into the system,” he said. “Make sure everything is up to scratch again.”

But he said critical information about the data breaches is still unresolved.

“We also await further information and transparency from the CDK,” he said. “Was customer data compromised at some point in an unencrypted way?”

This report by The Canadian Press was first published on June 24, 2024.

The Canadian Press