CDK Global cyberattack still crippling car dealers

Summary

Following a major cyberattack on CDK Global, a software provider for car dealerships, many businesses are still struggling to operate fully, reverting to manual processes. The ransomware attack on June 19th has led to an estimated financial loss of at least $944 million due to business interruptions. Experts suggest that recovering from such intrusions can take weeks to months, emphasizing the need for businesses to focus on multifactor authentication, system patching, and proactive defense measures to harden against future attacks.

Takeaways

• 🚨 A major cyberattack on CDK Global, a company providing software for car dealerships, has caused significant operational disruptions.
• ⏱️ Recovery from the ransomware attack is expected to take weeks to months, which is common for enterprise-wide intrusions.
• 🔒 The process involves ensuring the threat actor no longer has access, investigating the breach, and recovering systems.
• 💡 Hardening the environment to prevent re-hack is as important as recovery, emphasizing the need for robust security measures.
• 💸 The estimated financial loss from the outage could be at least $944 million due to business interruptions over the first three weeks.
• 📈 Extortion operations targeting organizations in the United States are frequent, with ransomware a common method to demand payments.
• 🏥 There has been an increase in targeted attacks against healthcare organizations, indicating a shift in threat actor focus.
• 🛡️ Multifactor authentication is crucial for defending networks against unauthorized access.
• 🔄 Regular patching of systems and software is critical to maintaining security and preventing intrusions.
• 🕵️‍♂️ Engaging ethical hackers to test network defenses before threat actors can exploit vulnerabilities is recommended.
• 🎯 Businesses should assume a level of intrusion and build defensive controls to minimize the impact of an attack on operations.

Q & A

What major event occurred nearly two weeks prior to the script's recording?

A major cyberattack on a company that provides software for car dealerships took place.

Which company was affected by the cyberattack?

CDK Global was the company affected by the ransomware attack.

What systems does CDK Global provide for car dealerships?

CDK Global provides systems to help run operations, manage inventory, and handle customer relations.

Why have some car dealerships had to revert to using paper and pen?

Due to the cyberattack on CDK Global, many car dealerships are not fully functioning and had to revert to manual processes.

What was the expected date for the systems to be back to normal operations?

The systems were expected to be back by July 4th.

What is the estimated financial loss from the outage over the first three weeks?

The estimated financial loss from the outage is at least $944 million due to business interruptions.

Why does it take several weeks to recover from an enterprise-wide intrusion?

It takes time to ensure the threat actor no longer has access, perform investigative work, recover systems, and harden the environment to prevent re-intrusion.

What is the common pattern in extortion operations against organizations in the United States?

Extortion operations often involve the deployment of ransomware and the demand for extortion payments from threat actors.

Which sectors have been targeted by threat actors in recent attacks?

Sectors such as healthcare, supply chain organizations, and banking have been targeted.

What is the role of Charles Carmichael in the context of this discussion?

Charles Carmichael is a consultant from the organization of Google Cloud, discussing the cyberattack and recovery process.

What are some fundamental measures businesses can take to harden their targets against cyber threats?

Businesses should focus on multifactor authentication, engaging ethical hackers to test defenses, patching systems and software, and building defensive controls and visibility across the environment.

Are there certain types of businesses that are more likely to be targeted by threat actors?

Threat actors are opportunistic and target any organization capable of paying multimillion-dollar demands, but there has been a noticeable increase in targeted attacks against healthcare organizations.