Spokane car dealers lose services to cyber attack

On an otherwise typical morning last month, Bob McLean, general manager of Findlay Lexus, arrived to find the computer system at their downtown Spokane car dealership to be unresponsive.

He and other employees scrambled to find a solution. At the time, they were unaware that thousands of other dealerships across the nation were experiencing a similar chaos.

“There was a period of a few days where we were trying to figure out everything,” McLean said.

The Lexus dealership is one of about 15,000 that uses operating software created by CDK Global. A series of ransomware attacks began on June 18 targeting the software, which is referred to as a dealer management system. Most of the dealerships using the software were compromised, according to a CDK release.

As a result, operations including point-of-sales, payroll, finance and other key functions stopped as CDK shut down all of its systems immediately following the attacks.

This left the Lexus dealership unable to schedule appointments to service cars. They couldn’t sell parts or cars – they couldn’t perform a simple oil change.

Dealership workers have found methods to circumvent the issues. McLean said on Monday the business has rebounded to allow it to perform most of its typical services, but accounting systems remained useless.

This has reduced them to completing transactions by handwriting invoices and receipts.

“Parts service and sales are what’s affected by it,” he said. “But we’ve come up with workarounds to get those processed.”

The attacks were executed by a Russian-based group, BlackSuit, which is known to steal sensitive information of victim organizations, lock up its systems and threaten to leak information if ransom payments are not received, according to Reuters.

By the end of 2023, BlackSuit had extorted more than $275 million from at least 350 known victims, according to the Unites States Cybersecurity and Security Infrastructure Agency.

CDK Global officials have not yet said publicly whether the company will make payments to the group. Last week, officials reported that full operations of its software have been restored to a handful of dealerships, but thousands of others are still left to complete transactions the old-fashioned way.

And it’s not just car sellers who suffered.

“We didn’t get hacked, but it still 100% affects us because we need to get parts from every single dealership in town, basically,” said Austin Adair, service manager at Mechanics Pride Tire & Automotive.

The cyberattacks occurred weeks ago, but the effects are still being felt, according to Adair.

“It’s the efficiency of getting parts that’s so hard,” he said. “Dealerships are getting them out, but still handwriting invoices.”

Adair identified a handful of his suppliers that were affected.

They include Subaru of Spokane, Camp Chevrolet, Corwin Ford, Findlay Toyota and George Gee Kia . Each of those dealerships was contacted by The Spokesman-Review. Those that were reached were not willing to comment for this story, and several others did not respond to requests to be interviewed.

Cody Burns, owner of Hopkins Auto Sales & Subaru Repair, also identified AutoNation Subaru in Spokane Valley as an affected dealership.

“The first day, it was really hard, by means of getting parts,” Burns said. “Today, pricing is the hardest. Since their systems are down, it’s difficult to get accurate prices for each part.”

AutoNation did not respond to requests for comment, but posted on its website: “We are experiencing issues with our system. Please call (888) 364-1084 to schedule your appointment. We apologize for the inconvenience.”

The cyberattacks affect dealerships’ ability to sell parts to auto body shops, but Adair believes it still affects customers as well.

He learned this from customers who were turned away from Findlay Toyota, which is right across the street from his shop at the corner of Second Avenue and Jefferson Street.

“It’s not just their point-of-sales, it’s their management software. So it affects appointments, scheduling, daily management – all that stuff,” he said. “During those early days, it brought us business.”

The shop offers “meat and potato services,” Adair said. This includes work to a car’s engine, drive train, suspension, brakes, electrical and more.

“That first day, I think I installed two batteries and did three oil changes for people that said Toyota couldn’t work on their car because computers were down,” he said. “So they came here.”