What the CDK Outage Taught Dealers About DMS Risk

Short version: On June 18, 2024, a ransomware attack knocked CDK Global offline for about two weeks and froze roughly 15,000 dealerships, costing the industry an estimated billion dollars while stores ran on paper. The real lesson isn't "CDK is bad" — it's that most dealers had never asked what happens when their DMS goes dark, and had no plan when it did. Here's what the outage exposed, and the questions you should be asking your vendor before the next one.

For two weeks in the summer of 2024, the modern dealership ran like it was 1985. No repair orders in the system. No parts lookup. No way to pull a customer's history. Service advisors wrote tickets on paper, parts guys called manufacturers by phone, and finance offices hand-wrote deals. The Anderson Economic Group pegged dealer losses at around $605 million in the first two weeks alone, on the way to an estimated billion-plus.

It wasn't a freak event. It was a predictable failure that the whole industry had quietly accepted as the cost of doing business. Let's break down what it actually taught us.

What actually happened

CDK Global, one of the largest DMS providers in the country, was hit by a ransomware attack on June 18, 2024. As the company worked to restore systems, it was reportedly hit a second time on June 20, which set recovery back further. Systems weren't fully restored until around July 4 — roughly two weeks of downtime for about 15,000 dealer locations across the U.S. and Canada.

During the outage, dealers reverted to manual, paper-based workflows. Some kept selling and servicing cars on sheer hustle. Many simply couldn't, because too much of the operation lived inside one system that was now dark.

The real lesson isn't "CDK is bad"

It's tempting to make this about one vendor. That misses the point. Any system can be attacked — bigger systems are bigger targets. The dealers who got hurt worst weren't the ones on the "wrong" DMS. They were the ones who had:

• All their eggs in one basket — every department dependent on a single platform with no fallback.
• No offline plan — no paper process anyone remembered how to run, no recent export of their own data.
• No clear answer from their vendor on what happens during an outage and how fast recovery is supposed to take.

The outage didn't create those weaknesses. It exposed them.

The questions every dealer should be asking now

Whether you're staying put or shopping, sit your DMS vendor down and get real answers to these. Vague answers are answers.

1. What's your actual uptime, and where is it published? Not a marketing promise — a number you can see.
2. If you go down, what's the recovery plan and the expected timeline? Who calls me, and when?
3. Can I get a full export of my own data, on demand, in a usable format? Your customer list, RO history, and accounting are yours. You should be able to walk out with them.
4. What's your security posture? How is my data protected, and what happens to it in a breach?
5. What does it cost to leave, and how long is the contract? Lock-in is its own risk — if switching is painful, you'll tolerate problems you shouldn't.

If a vendor gets defensive or hand-wavy on any of these, that tells you how the next outage will go.

Build your own contingency plan (no matter what system you run)

You can't control whether your vendor gets attacked. You can control how badly it hurts. A basic dealership continuity plan:

• Export your data on a schedule. A monthly export of customers, ROs, and key accounting reports, stored somewhere safe, means you're never fully blind.
• Keep a paper fallback that someone actually knows. A simple manual RO and deal process, documented, so the first day of an outage isn't the day you invent one.
• Know your phone tree. Manufacturer parts lines, lender contacts, and key vendors — the numbers you'd need if the system that stores them is down.
• Ask about it in your next vendor review. Make continuity a standing question, not a crisis conversation.

None of this is glamorous. All of it matters the day something breaks.

Where Auto Expert fits — honestly

We'll be straight, because this topic deserves it. Auto Expert is a newer, cloud-based DMS, and we built it cloud-first partly because of exactly this kind of risk. But we're not going to tell you we're immune — no honest software company can, and anyone who does is selling you something. We're early, and we haven't weathered a decade of attacks the way the incumbents have.

What we will say is that the questions above are the ones we think every dealer deserves a real answer to, including from us. Data you can export, contracts that don't trap you, and a team that picks up the phone aren't features — they're the baseline. If your current vendor can't meet that bar, it's worth looking around.

FAQ

How long was CDK down in 2024? About two weeks. The ransomware attack hit June 18, 2024, and systems weren't fully restored until roughly July 4, affecting around 15,000 dealerships.

How much did the CDK outage cost dealers? The Anderson Economic Group estimated roughly $605 million in dealer losses in the first two weeks, with total industry impact estimated at over a billion dollars.

What should I ask my DMS vendor about downtime? Ask for their published uptime, their outage recovery plan and timeline, whether you can export your own data on demand, their security posture, and your contract's exit terms.

Can a cloud DMS go down too? Yes. No system is immune. The point isn't cloud versus on-site — it's whether your vendor has a real recovery plan and whether you have your own contingency and data export.