CDK cyber attack: how should auto dealers oversee their DMS provider?

What happened to dealers during the CDK cyber attack?

The CDK cyber attack began on June 19, 2024, when CDK Global told its dealer customers it was experiencing a cyber incident and its dealer management system went offline. For dealers on that platform, the system that runs sales, F&I and service was suddenly unavailable. Public dealer groups described the impact in SEC filings, which give a clear record of what a DMS outage does to a dealership.

AutoNation's 8-K said the outage hit the DMS that runs its sales, service, inventory, customer relationship management and accounting, and that its stores kept operating with manual and alternative processes at reduced productivity. Group 1 Automotive said it activated its cyber incident response procedures and isolated its systems from CDK's platform. Sonic Automotive later concluded the incident had a material impact on its second-quarter results and reported operational disruptions throughout July tied to certain CDK customer lead applications.

One vendor held the deal jacket, the credit application and the repair order history for every dealer on that platform. The FTC Safeguards Rule already treats that vendor as part of the dealer's information security program, and the outage showed what that means in practice.

Is your DMS provider a service provider under the Safeguards Rule?

In most cases, yes. 16 CFR 314.2(r) defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to a financial institution covered by the rule. A DMS that hosts deal files, credit applications and F&I records fits that definition.

Dealers that finance, arrange financing or lease vehicles for longer than 90 days are financial institutions under the rule (see our guide to credit applications under the Safeguards Rule). The FTC's auto dealer FAQ adds that a third party must be providing you a service to qualify, and that an OEM is not a service provider unless it provides services to you.

The DMS is rarely the only one. CRM platforms, F&I menu tools, credit bureau connectors, desking software, digital retail tools and your IT provider often reach the same records. Each one that has access to customer information through a service it provides to you is a service provider in its own right.

What does the rule require you to do about it?

16 CFR 314.4(f) sets three duties: take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require them by contract to implement and maintain those safeguards, and periodically assess them based on the risk they present and the continued adequacy of their safeguards.

The FTC's auto dealer FAQ says you do not have to get a provider to agree to meet every Safeguards Rule requirement. It does say a vendor with direct access to your network should be required to use multi-factor authentication, and a vendor that stores or processes customer information should be required to encrypt it. The FAQ reflects FTC staff views and is not binding on the Commission, and it notes that the exact steps depend on the nature of the services the provider performs.

For a DMS provider, selection and contract terms usually cover:

• Encryption of customer information in transit and at rest, consistent with 16 CFR 314.4(c)(3).
• Multi-factor authentication for anyone who accesses your environment or your data, consistent with 16 CFR 314.4(c)(5).
• Prompt notice to you of security events that affect your systems or your customers' information, with a stated timeframe.
• Access to evidence, such as independent assessment reports, penetration test summaries or a completed security questionnaire.
• Recovery commitments: expected restoration times, where backups live and how you get your data out if the relationship ends.

Does a DMS outage count if no data was stolen?

Yes, it can count as a security event. 16 CFR 314.2(q) defines a security event as an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on it, or customer information held in physical form. An attack that takes your DMS offline disrupts a system that holds your customer information.

That matters because 16 CFR 314.4(h) requires a written incident response plan to respond to and recover from security events that materially affect the confidentiality, integrity or availability of customer information in your control. The plan must define roles and decision-making authority, internal and external communications, remediation requirements, documentation, and review of the plan after an event. The written risk assessment under 314.4(b)(1) must also address availability, so an extended DMS outage belongs in it.

Ask whether your plan answers the questions dealers faced in June 2024: who decides to cut off integrations with the provider, how deals and repair orders run without the DMS, and how the paper credit applications created during the outage are secured, entered later and disposed of. Paper records count too, since the definition reaches customer information held in physical form.

What if your DMS provider has a breach of customer data?

A breach at your DMS provider can still involve your customers' information, so you need a plan for FTC notice before it happens. Customer information under 16 CFR 314.2(d) includes records handled or maintained by you or on your behalf, so the data your DMS provider holds for you is still your customers' information. When unencrypted customer information about at least 500 consumers is acquired without authorization, 16 CFR 314.4(j) requires notice to the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form.

The rule presumes unauthorized acquisition whenever there is unauthorized access to unencrypted customer information, unless there is reliable evidence that acquisition did not or could not reasonably have happened. That evidence usually sits with the provider's forensic team, so your contract should give you a right to the findings. Neither the rule text nor the FTC's auto dealer FAQ spells out how reporting works when the breach happens at a vendor, so settle with counsel in advance who files and on what facts. Our walkthrough of the FTC breach report covers the form itself.

The FTC has acted against a DMS provider before. In its 2019 settlement with LightYear Dealer Technologies, which did business as DealerBuilt, the FTC alleged the company stored unencrypted information on about 12.5 million consumers for 130 dealer customers, that a hacker downloaded data on more than 69,000 consumers, and that DealerBuilt learned of the breach from a dealer customer. The order requires biennial third-party assessments. Your provider may not be the first to notice a problem.

How often should you reassess the DMS provider?

The rule sets no fixed interval. Section 314.4(f)(3) ties reassessment to the risk a provider presents, and a DMS holding every deal file sits at the top of most dealers' risk tiers. A practical cadence is to review it at least annually and again after any incident, ownership change or major platform change. Our article on vendor oversight after the contract covers how to tier and document reviews.

Results feed your governance records. Under 16 CFR 314.4(i), the Qualified Individual reports in writing at least annually to the board or a senior officer, and the report addresses material matters including service provider arrangements. Section 314.4(g) requires you to evaluate and adjust the program in light of testing, monitoring and material changes to your operations or business arrangements. See what the Qualified Individual's board report must cover.

What should a dealer do this quarter?

Start with the DMS and work outward to every vendor that touches customer information.

• List every service provider with access to customer information, including the DMS, CRM, F&I, credit and digital retail tools and your IT provider, and note which have direct access to your systems.
• Pull the DMS contract and check it for safeguards, notice of security events, evidence access, forensic findings and data return.
• Request the provider's current independent security assessment and file it with a dated review note.
• Confirm multi-factor authentication on every user and vendor account that reaches the DMS, or document the Qualified Individual's written approval of an equivalent control.
• Run a tabletop exercise on a week-long DMS outage: who isolates integrations, how deals and repair orders run, and how paper records are stored and disposed of.
• Set a risk-based reassessment schedule and add the results to the Qualified Individual's next board report.

How does s90 help dealers?

s90 runs IT and security for regulated firms in Los Angeles and Orange County. For dealers, that means a maintained service provider inventory, collected and reviewed vendor evidence, multi-factor authentication and isolation on DMS integrations, and an outage tabletop run with your team. If you want a second look at how you oversee your DMS provider, we are glad to walk through it with you.