“Dicey” — Several Windsor car dealerships caught in massive cyberattack

Article content

Many Windsor-Essex car dealerships were still doing business with pen and paper this week after back-to-back cyberattacks on the U.S. company that supplies their software systems.

“This program manages all of our sales, accounting, service and parts,” said Rony Brandi, director of new car sales at Windsor Chrysler. “This software helps us manage our inventory. On the sales side, it calculates payments. The same goes for after-sales service, spare parts, everything. »

Article content

“It’s difficult without the system. We can’t see our inventory in the system. We use different sources to price vehicles. A little difficult. We use old-fashioned pen and paper instead.

The targeted company, CDK Global, provides software to approximately 15,000 dealerships in North America.

Bloomberg News reported that a hacking group called BlackSuit carried out the cyberattack. The outlet also reported that the criminals had demanded a ransom of tens of millions of dollars, and that CDK Global planned to pay.

This is the latest in a series of cyberattacks that have had disastrous consequences for several organizations in southwestern Ontario.

Patient data from five hospitals, including Windsor Regional Hospital, Hôtel-Dieu Grace and Erie Shores HealthCare, was stolen in October after third-party agency Transform Shared Service Organization was targeted. The hospitals did not pay the ransom.

In June 2022, hackers also hit the University of Windsor, which still refuses to provide details about the incident. Due to the secrecy surrounding the matter, it is unclear whether the university paid a ransom, what was affected, or how many students and staff may have been affected.

Article content

The attack on car dealerships and CDK Global began on June 19. It impacted thousands of businesses across the United States and Canada, including several dealerships in the Windsor area.

The Canadian Association of Automobile Retailers Associations, a national organization representing new car and truck dealers, would not comment to the Windsor Star.

Alberta-based AutoCanada Inc., which owns about 75 dealerships including Rose City Ford, Audi Windsor and Premier Chevrolet Cadillac Buick GMC, said in a statement this week that its dealer management systems were down.

These systems support operations including sales, service, inventory and accounting.

The company said it did not yet know how much customer or supplier data the “threat actor” may have accessed.

“AutoCanada immediately took precautionary measures to protect our systems and is currently reviewing the potential impact of the incident, and efforts continue,” the company said. “We have not identified any compromise or unauthorized access to our systems.

“This incident has had, and will likely continue to have, a negative impact on the company’s business operations until the affected systems are fully restored. Our dealerships remain open and we continue to sell and service vehicles, as well as serve our customers through manual and alternative processes. »

Article content

Brandi also said it appears no customer information was compromised, but added that CDK has provided little information about it.

“It’s not really clear,” he said.

The attack did not stop with the hackers’ intrusion into the computer systems. Brandi said CDK has been warning customers about people calling pretending to be employees of the company.

“They told us the system had been hacked and people were calling pretending to be CDK and trying to get personal information,” Brandi said. “You have to be really careful.

“It’s a bit risky.”

He said the dealership is still open, selling vehicles and booking service appointments, but things are taking longer than usual because they had to switch to analog until systems are restored.

In the after-sales service, work orders are drawn up by hand. It takes half an hour to price a vehicle.

“Typically, it takes a few minutes to price a vehicle,” Brandi said. “Now just a few minutes, multiply it by 10.

“This backend system allows us to price vehicles. We now use multiple sources. We used to do it all at once, so I could pull all my inventory. Now, to find a car, I have to physically go out there, find it, and plug that VIN number into the Chrysler website to get the invoices and everything else.

Article content

“Before, it was just a click of a button and I could calculate payments and so on.”

Brandi said the dealership’s financing and leasing systems are separate from the software involved.

To make up for the drop in sales caused by the cyberattack and the headache for customers, he said Windsor Chrysler is holding a sale on the vehicles through Tuesday. The dealership sent an email stating that they “write contracts with the good old pen, paper and a handshake.”

“We’re giving a little extra discount on vehicles to make up this month for what we lost last week,” he said. “My partner sent the cyberattack email and we received a response.

“We had people come. So it was good.

[email protected]

Article content