When Dealership Software Goes Down: IT Lessons from 2024

In June 2024, a cyberattack on CDK Global, a software provider that says it serves more than 15,000 dealership locations across North America, took its systems offline. Dealerships that ran their sales, finance, service and parts operations on that software went back to pen and paper, and it was days before systems started coming back.

Most of those dealerships did nothing wrong. Their own networks were not the ones attacked. That is the lesson worth holding on to: your store can be stopped by a problem at a company you depend on, and the time to plan for that is before it happens.

What the outage showed

A dealer management system touches almost everything: deals, financing paperwork, repair orders, parts inventory, payroll and customer records. When it goes dark, every department feels it at once. Stores that coped best had three things in common. They knew which tasks could be done by hand, they had the forms and phone numbers to do it, and someone was clearly in charge.

Seven steps that keep a dealership moving

1. Map what depends on what. List your core systems: DMS, CRM, phones, key machines, service scheduling and payment terminals. Note which ones stop working if another one fails.
2. Keep a manual plan, and practice it. Printed deal forms, repair orders, price lists and a contact sheet. Walk each department through it once a year.
3. Keep your own copies where you can. Where your vendor allows it, export key reports on a schedule, such as open repair orders, inventory and customer lists, and store them securely.
4. Separate your networks. Guest Wi-Fi, service bay equipment, office computers and vendor connections should not all sit on one flat network. Good network design keeps a problem in one area from spreading to the rest.
5. Lock down vendor and remote access. Every outside connection should use its own account and multi-factor authentication. Remove access nobody uses anymore.
6. Back up what you control, and test it. File servers, accounting, email and scanned documents all need backups you have actually restored from.
7. Decide who makes the calls. A short incident plan with names, roles and phone numbers. Print it, because the day you need it your computers may be off.

There is a compliance side too

Dealers that finance or lease vehicles are covered by the FTC Safeguards Rule, which requires a written incident response plan and oversight of the service providers that handle customer information. The FTC’s guide to the rule lays out what is expected. Planning for a vendor outage is good business, and for most dealers it is also part of the rule.

Questions to ask your software vendors

• How will you notify us if you have a security incident?
• How are our data backed up, and how long would recovery take?
• Can we export our own data on a regular schedule?
• Who can access our systems remotely, and how is that access protected?

Xceltek works with dealer management platforms and the vendors around them as part of our IT services for automotive businesses, alongside cybersecurity for the systems you run yourself.

Common questions