Ransomware (extortion): Garage and car dealership, USA 2024
In June 2024, the BlackSuit group paralysed the software provider CDK Global, whose systems for sales, workshop and stock are used by more than 15'000 car dealerships in North America.
- Incident · 06.2024 · North America, USA
- Evidence: several media
- Ransomware (extortion)
- Attack via a supplier
As of
What happened
A second attack occurred during the restoration. According to reports, CDK paid around 25 million dollars; the company did not confirm this.
- Affected
- CDK Global and affiliated car dealerships
- Industry
- Garage and car dealership
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / yes
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income if the cloud or a provider is attacked
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Garages and car dealerships that depend entirely on one sector software need contingent business interruption insurance for service providers and a paper-based emergency operation.
Sources
- CDK Global outage caused by BlackSuit ransomware attack (opens in a new window) BleepingComputer · 2024-06
- BlackSuit Hackers Blamed in Paralyzing CDK Ransomware Attack (opens in a new window) Bloomberg Law · 2024-06