The CDK Global (BBU) cyberattack that crippled dealerships across North America appears to be on its way to resolution. But the damage has already been done: lost sales and service revenue could be significant.
On Wednesday evening, CDK Global released a statement with the company’s first positive news since the cyber attack began on June 19.
“We have successfully brought a small initial test group of dealers live on the Dealer Management System (DMS), and once validation is complete, we will begin phasing in additional dealers,” the company said in a statement to Yahoo Finance. “We are also actively working to bring additional applications live — including our Customer Relationship Management (CRM) and service solutions — and our customer service channels.”
CDK tried to restore services last week, but had to back down after a second cyber attack. CDK subsequently admitted that the perpetrators demanded ransoms to restore services; Bloomberg separately reported that the group behind the attack, BlackSuit, is based in Eastern Europe and was demanding tens of millions of dollars. Currently it is unclear whether CDK Global has paid a ransom; When asked by Yahoo Finance about the payment, the company declined to comment.
Still, the new phased rollout of its DMS seems to be a step in the right direction. However, public auto dealer groups such as AutoNation (AN), Group 1 Automotive (GPI) and Lithia Motors (LAD) warned that their second-quarter financial results were likely to be affected by the outage. The companies have turned to alternative ways of documenting sales and services, with some even using pen and paper to record transactions.
A service center in Illinois is suing CDK Global over the loss of business caused by the cyber attack. Other DMS operators, such as Dominion, have indicated that automakers are also looking to audit their software to test cybersecurity effectiveness.
Because systems have been affected for more than a week, automotive research firms are predicting sales losses for the month of June and the second quarter.
“Due to disruptions to dealer software systems, June sales will not reflect actual consumer demand for new vehicles. Instead, a significant number of sales that would have occurred in June will now likely occur in July,” Thomas King, J.D. Power’s president of data and analytics, said in a statement.
King and J.D. Power expect total sales in June to fall from an initial projection of 1.41 million units to between 1.27 and 1.33 million units for the month, or a sales decline of 2.6% to 7.2% compared to a year ago.
On the bright side, these lost sales could reappear in July. But even a lost week, or a slow sales week, in June could also impact overall second-quarter sales for dealer groups and automakers, following the historically strong period in late June.
“CDK’s cyber attacks have thrown a spanner in the works for sales in the second half of June, impacting what is likely one of the most lucrative and busiest times of the month and quarter for dealers,” said Jessica Caldwell, chief insights from Edmunds. “While the impact of these attacks will vary by dealer, this event is another bump in the auto industry’s long road to recovery.”
Caldwell noted that despite high interest rates and other headwinds, new-vehicle sales should remain strong in the second quarter due to healthier inventory levels and the return of summer incentives. But like J.D. Power, Edmunds now expects sales to push back to the third quarter, meaning it can recoup the revenue losses.
As second-quarter earnings season begins next month, investors will get a clearer picture of the cyberattack’s impact on sales per dealer group and total quarterly deliveries for volume automakers such as Ford, GM and Toyota.
Pras Subramanian is a reporter for Yahoo Finance covering the auto industry. You can follow him Tweet and further Instagram.
Click here for the latest stock market news and in-depth analysis, including events affecting stock prices
Read the latest financial and business news from Yahoo Finance
