Loading story…
A cyberattack on CDK Global knocked key dealership management systems offline and disrupted operations at thousands of auto dealerships across the United States. Dealers reported being unable to access core functions for sales, financing, service, and vehicle records, forcing many to switch to manual paperwork and delaying transactions. After suffering two related intrusions, CDK also warned customers that threat actors were attempting social-engineering attacks against dealerships during the outage, raising concerns that criminals were exploiting the disruption to gain further access or steal information.
The outage quickly translated into major financial damage across the automotive retail sector. Industry estimates cited losses that could approach $1 billion, reflecting stalled vehicle sales, service delays, and operational backlogs. Separate reporting later said CDK Global was believed to have paid roughly $25 million in ransom to the attackers as the company worked to restore systems and stabilize customer operations, underscoring the scale of the incident and its downstream impact on the dealership ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A study reported that financial losses tied to the CDK outage could approach $1 billion for affected car dealerships. The estimate highlighted the scale of business interruption caused by the prolonged disruption.
A later report stated that CDK Global paid approximately $25 million in ransom to the hackers behind the attack. The payment was described as part of efforts to resolve the incident and restore operations.
After the two intrusions, CDK Global warned customers to watch for social-engineering and phishing attempts exploiting the incident. The company advised dealerships to be cautious of actors impersonating CDK or related support personnel.
While restoring services after the initial breach, CDK Global was reportedly struck by a second cyberattack, prolonging the outage and continuing disruption for dealerships. Reports indicated the incidents had broad operational impact across the automotive retail sector.
CDK Global experienced a cyberattack that forced it to take systems offline, disrupting software used by thousands of U.S. auto dealerships. The outage affected core dealership operations including sales, financing, and service workflows.
4 references tracked. Mallory keeps watching after this page renders.
motortrader.com
Open sourcefoxbusiness.com
Open sourcescmagazine.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian security systems provider **Delta** said it was hit by a cyberattack that disrupted services used in commercial facilities, private homes, and automobiles. Reports said customers experienced widespread failures in vehicle security functions, including cars that would not start, alarms that could not be turned off, and vehicles that could not be opened, while some users were told recovery might require dealer reflashing. At the same time, Delta’s website was unavailable and its phone lines were reportedly unreachable, compounding the outage. The incident drew concern because Delta’s products are used for remote protection and access control, raising the prospect of broad operational disruption for customers. Delta confirmed the cyberattack to Russian media, but no actor had been publicly identified, and there was no confirmed evidence of a personal data leak despite customer fears that account or vehicle-related information may have been exposed.
Jun 29, 2026
A **cyberattack** disrupted operations at **Delta**, a Russian provider of alarm and security systems for homes, businesses, and vehicles, causing widespread outages and customer complaints. Delta described the incident as a “**large-scale**” and “well-organized” external attack, with company leadership claiming it originated from an unspecified **hostile foreign state**; Delta also said it had **no evidence** at the time that customers’ personal data had been compromised. As services went down, Delta’s **website and phone lines** remained offline into the following day, forcing the company to communicate with customers via **VKontakte** while it worked to restore systems from backups amid concerns about follow-on attacks. The outage had immediate real-world impact, particularly for users of Delta’s vehicle security features: reports described customers being unable to **unlock cars**, **disable alarms**, or use **remote start**, with some accounts alleging doors locking unexpectedly and even **engines shutting down while in motion**. Separate reporting noted Delta’s app (launched in 2020) supports tracking vehicle location and stores **payment data**, increasing customer concern about potential exposure if Delta’s internal systems were breached; however, no threat actor has claimed responsibility and it remains unclear whether the disruption was caused by **DDoS** or a more destructive intrusion such as **ransomware** or a **wiper**.
Jun 29, 2026
Jaguar Land Rover suffered a significant cyberattack in September that forced the automaker to halt production for several weeks, resulting in a 43% year-on-year decline in wholesale volumes for the third quarter. The disruption affected global supply chains, with manufacturing only returning to normal levels by mid-November, and led to substantial delays in distributing vehicles to dealers worldwide. The attack's impact was felt across all major markets, with North America experiencing a 64% drop in wholesale volumes, Europe 48%, China 46%, and the UK market seeing a smaller decline of 0.9%. The company also faced additional challenges from US tariffs and the planned discontinuation of legacy Jaguar models. Financially, the cyberattack cost Jaguar Land Rover £196 million ($220 million) in the quarter, and the Bank of England cited the incident as a contributing factor to the UK's weaker-than-expected GDP growth. The attack was later claimed by the Scattered Lapsus$ Hunters, a group linked to Lapsus$, Scattered Spider, and ShinyHunters. In addition to production and sales losses, JLR confirmed that data was stolen during the breach, including payroll information. The full financial impact is expected to be detailed in the company's upcoming quarterly results.
Jun 29, 2026