Speaker 1: Bloomberg Audio Studios, podcasts, radio news.
Speaker 2: Deborah Griffith has been working with car dealerships on and
Speaker 2: off for over forty years, processing warranty claims. A few
Speaker 2: weeks ago in mid June, she logged onto her computer
Speaker 2: at work and noticed that a key bit of software
Speaker 2: she uses, made by a company called CDK, had stopped working.
Speaker 3: I've never experienced anything like that. I'm like, what in
Speaker 3: the world is going on.
Speaker 2: CDK is used by an overwhelming majority of dealers in
Speaker 2: the country to track purchases, parts, and warranties. But CDK
Speaker 2: had been offline for hours. Short outages weren't that unusual.
Speaker 2: What was strange this time was that Deborah hadn't seen
Speaker 2: an update from CDK about any upgrades or maintenance.
Speaker 3: CDK has a service portal, and if something goes wrong nationwide,
Speaker 3: they'll put a message on there, like like any website
Speaker 3: you know works experiencing this outage, you know, and we're
Speaker 3: working on it, you know, something like that, And there
Speaker 3: was nothing there.
Speaker 2: Eventually, Deborah got a call from one of her contacts.
Speaker 3: He called me and he said, I just got a
Speaker 3: call from CDK corporate. Everyone has to log out right
Speaker 3: now and he goes, I mean, right now, there's something
Speaker 3: going on. They've been hacked. You know, tell your bosses,
Speaker 3: call your company and tell them everyone needs to log
Speaker 3: out right now.
Speaker 2: Activity at dealerships across North America ground to a halt
Speaker 2: as CDK shut down its systems on June nineteenth in
Speaker 2: response to the hack. Dealers couldn't access their inventory, buyers
Speaker 2: couldn't get cars off the lot, and Deborah couldn't process
Speaker 2: any warranty claims. Just how disruptive was this to the
Speaker 2: work that you try to do?
Speaker 3: Very absolutely, very very There's nothing, absolutely nothing I can do,
Speaker 3: absolutely nothing.
Speaker 2: Summer is a particularly important time for the car industry,
Speaker 2: and in the middle of a crucial season, buyers, dealers,
Speaker 2: and owners looking to repair their vehicles were left in
Speaker 2: the lurch. Data out on Tuesday showed slowing growth for
Speaker 2: US car sales. Toyota reported a dip of one point
Speaker 2: two percent in June compared to last year, while Kia
Speaker 2: saw a six point five percent decrease. Some companies that
Speaker 2: reported their quarterly earnings saw slight jumps in sales in
Speaker 2: Q two. For General Motors appoint six percent rise, but
Speaker 2: that's compared to an increase of nineteen percent last year.
Speaker 1: It's millions of dollars worth of sales.
Speaker 2: Bloomberg Senior Technology editor Dana Wallman has been leading a
Speaker 2: team that's been reporting on the hack.
Speaker 1: I mean, even single car dealerships are saying that they've
Speaker 1: lost millions of dollars in transactions. It really is. It's huge.
Speaker 2: According to independent outlets, the group behind the hack is
Speaker 2: known as Black Suit, and they reportedly demanded a ransom
Speaker 2: of tens of millions, of a ransom that Bloomberg is
Speaker 2: reporting CDK agreed to pay because the consequences of keeping
Speaker 2: CDK offline for long would be devastating for the car industry.
Speaker 1: It's last sales during a busy period, and I don't
Speaker 1: know that all dealerships will be able to make that up.
Speaker 2: Today on the show, how a sophisticated group of hackers
Speaker 2: took down the car sales industry for a few crucial weeks,
Speaker 2: What the road to recovery for dealerships will look like,
Speaker 2: and where hackers might target next. I'm Sarah Holder, and
Speaker 2: this is the big take from Bloomberg News. The software
Speaker 2: company CDK Global is not exactly a household name, says
Speaker 2: Bloomberg Senior Technology editor Dana Wallman.
Speaker 1: CDK is not a company I'd heard of, admittedly, before
Speaker 1: this story broke, I actually don't know how many of
Speaker 1: my colleagues had heard of this, and I'm guessing a
Speaker 1: lot of our readers had not heard of this company either.
Speaker 2: But for car dealership across North America, the custom software
Speaker 2: CDK provides is mission critical.
Speaker 1: It's used to manage pretty much every aspect of their
Speaker 1: day to day business, from scheduling appointments to tracking inventory
Speaker 1: in addition to completing transactions. So without that software, business
Speaker 1: would ground to a halt and.
Speaker 2: Has Chances are if you've bought a car at a
Speaker 2: dealership in the US, your data has gone through the software.
Speaker 2: It's used by around fifteen thousand auto dealers in North America.
Speaker 2: They do have competitors, but they clearly are the dominant
Speaker 2: player in this very specialized field. According at least to
Speaker 2: CDK itself, before this attack, the transactions that were being
Speaker 2: done through the software accounted for something like two percent
Speaker 2: of GDP for context, that's around five hundred and sixty
Speaker 2: five billion dollars. This near monopoly makes CDK a healthy profit.
Speaker 2: The company was acquired by the asset management company Brookfield
Speaker 2: for eight point three billion dollars a little over two
Speaker 2: years ago, but its status also makes the company a
Speaker 2: vulnerable mark for a cyber attack.
Speaker 1: It began on Juneteenth, a federal holiday in the US,
Speaker 1: and it was a day that car dealers were expecting
Speaker 1: to be a busy sales day during what is already seasonally,
Speaker 1: mind you, a busy season.
Speaker 2: That day, news broke that an experienced cybercrime operation called
Speaker 2: black Suit, which we'll get into in a little bit,
Speaker 2: had breached the CDK system that forced CDK to shut
Speaker 2: down the system as they dealt with the disruption, CDK
Speaker 2: has said it anticipates everything will be back online by Thursday,
Speaker 2: the fourth of July holiday, but in the meantime, for
Speaker 2: all the dealerships that rely on its service, losing access
Speaker 2: to CDK has been like trying to work as an
Speaker 2: Instagram influencer with Instagram down, or trying to make a
Speaker 2: podcast during a slackoutage. It's extremely disrupt.
Speaker 1: It either entirely or mostly brought business to a halt
Speaker 1: at these dealerships. It wasn't just like they couldn't complete
Speaker 1: sales of cars. We know that, but there are other
Speaker 1: things that I didn't even think about that a car
Speaker 1: dealership might be doing, like trying to swap inventory with
Speaker 1: another dealer, for instance, maybe another dealer has a specific
Speaker 1: configuration of a car that your customer wants. Another specific
Speaker 1: example was the finding of replacement parts. There's a database
Speaker 1: where you could look up parts for customers who need something.
Speaker 1: Locating those parts is very hard when they're tracked online
Speaker 1: or indexed online and you can't get to those systems.
Speaker 1: Many of these dealerships were out of service and they
Speaker 1: were either not serving customers or they were sort of
Speaker 1: resorting to this old fashioned way of dealing with people.
Speaker 2: And data does mean old fashioned. Workers at these dealerships
Speaker 2: started handwriting contracts and logging oil changes on paper, and
Speaker 2: a few had to rely on their intuition some pretty
Speaker 2: critical decisions, like trying to gauge if buyers had good
Speaker 2: enough credit to drive off with a car.
Speaker 1: In a sense, just using their gut to make these decisions.
Speaker 1: It would otherwise be driven by data, really and hard numbers.
Speaker 2: Obviously, this has all been a huge pain for car
Speaker 2: sellers and for CDK, which is now facing lawsuits from dealers,
Speaker 2: repair shops, and customers. Those customers have something else important
Speaker 2: on the line, all that personal data the hackers also
Speaker 2: presumably got when they accessed cdk's systems. Should consumers be
Speaker 2: worried about this hack at all?
Speaker 1: I would be worried, and certainly in our reporting we've
Speaker 1: found that customers themselves have express worry. We visited some
Speaker 1: car dealerships in person and have found that, aside from
Speaker 1: the fact that the hack brought these systems to a halt,
Speaker 1: a more hidden impact of this hack is that customers
Speaker 1: are now wary of buying a car. They have read
Speaker 1: about this attack is the press and are a little
Speaker 1: nervous about handing over data to car dealerships. So I
Speaker 1: think beyond the question of should car shoppers be nervous,
Speaker 1: they are nervous, and it is having a hard to
Speaker 1: measure impact on car sales, even on top of the
Speaker 1: fact that a slowdown in modern systems is making it
Speaker 1: hard to transact.
Speaker 2: Coming up after the break, it's not just cars. We
Speaker 2: break down who is behind the CDK hack and why
Speaker 2: other companies should be on high alert. So here's where
Speaker 2: things stand. For nearly two weeks, thousands of car dealerships
Speaker 2: across the country have been unable to access CDK software,
Speaker 2: which is crucial for everything from assessing credit worthiness to
Speaker 2: figuring out what cars are available to be sold. That's
Speaker 2: resulted in millions of dollars in lost sales, and Bloomberg
Speaker 2: Senior Technology editor Dana Walman says figuring out who was
Speaker 2: behind the attack wasn't easy. Who is the hacking group
Speaker 2: behind the attack?
Speaker 1: So today at least they're called black Suit, and I
Speaker 1: say today at least because these groups do intentionally change
Speaker 1: their names, often to make themselves harder to track and
Speaker 1: keep tabs on.
Speaker 2: According to security experts, before Blacksuit was black Suit, they
Speaker 2: were also known as Royal. That group was responsible for
Speaker 2: a cyber attack about a year ago that forced the
Speaker 2: city of Dallas to shut down its computer systems, including
Speaker 2: one that the local fire department relies on to track emergencies,
Speaker 2: for four days. Firefighters in Dallas resorted to moving magnets
Speaker 2: around on a map to keep tabs on incidents and
Speaker 2: manage their crews. Some of Royal's members came from one
Speaker 2: of the most notorious hacking groups ever, Kanti, meaning Black Suit,
Speaker 2: has a pretty distinguished pedigree.
Speaker 1: They are really experienced group of hackers and extortionists. We
Speaker 1: describe them as sort of low key and business like,
Speaker 1: as if to say they're not trying to disrupt anyone.
Speaker 1: They're just trying to run a business.
Speaker 2: To run that business, Blacksuit uses a two pronged approach.
Speaker 1: First of all, they engage in what we've called in
Speaker 1: our reporting double extortion, that is the shutting down of
Speaker 1: services and also the threat to publish user data online.
Speaker 1: And we've also described them in a reporting as offering what's
Speaker 1: called ransomware as a service.
Speaker 2: Ransomware as a service, Dana says that means that Blacksuit
Speaker 2: essentially offers up its skill set hacking vulnerable companies or
Speaker 2: school districts or libraries to whoever wants to pay for it.
Speaker 1: In discussing this with my colleagues, I had first likened
Speaker 1: it to mercenaries, and one of my colleagues said, no, actually,
Speaker 1: they're more like arms dealers. Even if they're not committing
Speaker 1: the attack themselves, they are providing the cyber weapon and
Speaker 1: someone else is using them to commit the attack, and
Speaker 1: then everyone behind the scenes is profiting off of it.
Speaker 2: Sources have told Bloomberg that in general, Blacksuit demands a
Speaker 2: ransom of anywhere between three hundred thousand dollars and five
Speaker 2: million dollars, and Blacksuit demanded tens of millions of dollars
Speaker 2: from CDK, which planned to pay the ransom. According to
Speaker 2: a source who spoke to Bloomberg, they themselves have not
Speaker 2: listed CDK as a victim on their website, which we've
Speaker 2: reported is typical practice for them. Actually, they have on
Speaker 2: their website about close to one hundred victims listed, and
Speaker 2: those are just the ones who are listed. If if
Speaker 2: a victim did pay an extortion fee, their names don't
Speaker 2: even appear. And CDK, we've reported, intended to pay the ransomware.
Speaker 1: And also it's just in general, it is hard to
Speaker 1: get hackers to comment for a story on Bloomberg.
Speaker 2: So far, it's unclear if black Suit was acting on
Speaker 2: its own behalf or on behalf of someone else. The
Speaker 2: thing that I found so surprising was how black Suit
Speaker 2: went about getting access to cdk's systems. Dana says they
Speaker 2: did it through what's known as social engineering. In practice,
Speaker 2: that meant posing as employees. That's right, hackers posed as
Speaker 2: employees to trick customers into helping them access the company's systems.
Speaker 1: And it is a reminder too that not all hacking
Speaker 1: is what we imagine from seeing the movies, seeing hackers
Speaker 1: depicted in the movies. It isn't necessarily an exploitation of
Speaker 1: a vulnerability and code. There is sometimes this element of
Speaker 1: really convincing persuasion.
Speaker 2: Right. They didn't have to pack into the mainframe as
Speaker 2: we think of it. They literally had to just pretend
Speaker 2: they were employee and get access that way. In part, yeah,
Speaker 2: security analysts say CDK isn't the first organization to fall
Speaker 2: prey to Blacksuit's tactics. Recent victims also include the Kansas
Speaker 2: City Police Department and a school district in Georgia. But
Speaker 2: Dana says there's one sector in particular that she's most
Speaker 2: worried about.
Speaker 1: The world of healthcare, electronic healthcare providers. It is a
Speaker 1: huge industry, but I wouldn't say there's a ton of
Speaker 1: variety in that industry. I don't think it's that uncommon
Speaker 1: to see a quasi monopoly like the kind that CDK has,
Speaker 1: and I think a similar dynamic where once these companies
Speaker 1: are onboarded onto this software, it is difficult for them
Speaker 1: to get out and transfer to another piece of software,
Speaker 1: whether it's because they're locked into a five year contract,
Speaker 1: or it's difficult to migrate their data to something else,
Speaker 1: or because you've got all these employees who you have
Speaker 1: to train on new software when they could otherwise be
Speaker 1: getting work done.
Speaker 2: Recently, Britain's National Health Service said it was investigating claims
Speaker 2: that hackers had published confidential data stolen from several London hospitals.
Speaker 1: The hackers got access to this really sensitive patient data
Speaker 1: involving people's blood work and pregnant women.
Speaker 2: With the stakes around data vulnerability getting higher, I asked
Speaker 2: data if cdk's decision to pay the ransom could set
Speaker 2: a bad precedent. There's a school of thought that paying
Speaker 2: ransom will only encourage future hackers.
Speaker 1: Is that a worry here? I mean, without me editorializing myself,
Speaker 1: it is an active debate in the cybersecurity community, and
Speaker 1: I think there are people who do subscribe to the
Speaker 1: school of thought that as hard as it is to
Speaker 1: be named publicly and shamed and to accept the impacts
Speaker 1: that more broadly speaking, pulling the lens back, it is
Speaker 1: destructive in a longer term way to keep paying these ransoms.
Speaker 1: I would not say there's a consensus on that necessarily,
Speaker 1: but it does seem to be an active source of
Speaker 1: debate in the cyber threat community.
Speaker 2: Either way, Dana says that the CDK situation isn't likely
Speaker 2: to be the last one, and that the trend is
Speaker 2: towards more potentially devastating consequences than not being able to
Speaker 2: buy a car.
Speaker 1: These attacks seem relentless, and they have felt especially vicious.
Speaker 2: The CDK hack serves as a warning for any industries
Speaker 2: that are overly reliant on one piece of software, Dana says.
Speaker 2: But for now, Deborah Griffith is still just trying to
Speaker 2: deal with the mess this hack has created for her.
Speaker 3: So, I mean, it's yeah, chaos. That word you use
Speaker 3: is a very good word.
Speaker 2: You know what might happen if CDK doesn't get everything
Speaker 2: back online by July fourth? How might that affect the industry?
Speaker 3: I mean, if you're in a dealership, especially the service department,
Speaker 3: you know, every time something breaks that you don't want
Speaker 3: to break, you know, you can't just sit back and
Speaker 3: wine about it. You know, you just have to roll
Speaker 3: with it, and you have to, you know, come up
Speaker 3: with a solution. Don't cry about the reason why. You know.
Speaker 2: This is the big take from Bloomberg News. I'm Sarah Holder.
Speaker 2: This episode was produced by Alex Sugiura. It was edited
Speaker 2: by Aaron Edwards. It was mixed by Rishi Bajakol. It
Speaker 2: was fact checked by Thomas lu Our senior producers are
Speaker 2: Naomi Shaven and Kim Gettleson. Our senior editor is Elizabeth Ponso,
Speaker 2: Nicole bimsterbor is our executive producer. Sage Bauman is Bloomberg's
Speaker 2: head of podcasts. If you liked this episode, make sure
Speaker 2: to subscribe and review The Big Take wherever you listen
Speaker 2: to podcasts. It helps people find the show. Thanks so
Speaker 2: much for listening. We'll be off tomorrow for the fourth
Speaker 2: of July, but we'll be back on Friday.