Ransomware attacks CDK Global and public sector targets in June

While one of the most serious ransomware attacks in June targeted software provider CDK Global, the threat also had a devastating impact on local governments and paralyzed public services.

Ransomware attacks on the public sector continued last month, with several U.S. schools and cities reporting network disruptions in June that forced closures and difficult ransom decisions.

While local governments, cities and schools have been the primary targets of attacks, CDK Global fell victim to a ransomware attack that demonstrated just how disruptive this threat is to victim organizations.

On June 18, Illinois-based CDK Global began experiencing outages due to a ransomware attack. CDK Global is an automotive technology provider that currently services 15,000 dealerships. In a statement to The Record, CDK Global spokeswoman Lisa Finney said the provider proactively forced the majority of its systems offline to contain the attack, which caused disruptions that significantly impacted its end customers.

One customer, Sonic Automotive, reported in an 8-K filing on June 19 that CDK had notified customers that it was suspending certain system operations.

“As a result, the Company experienced disruptions in the operation of its Dealer Management System (“DMS”) operated by CDK, which supports key dealership operations, including sales, inventory management and accounting functions, as well as its Customer Relationship Management (“CRM”) system,” Sonic Automotive wrote in its Form 8-K filing.

That same day, Bleeping Computer reported that CDK had suffered a second attack while it was undergoing remediation efforts. Then, two days later, the cybersecurity news outlet revealed that attackers were calling customers and impersonating CDK agents to gain access to their systems. This technique, known as vishing, is becoming increasingly common in the threat landscape. The BlackSuit ransomware gang took responsibility for the CDK attack.

Since last Monday, USA today announced that CDK announced the resumption of operations on Thursday.

In another ransomware attack on the private sector, Patelco Credit Union in Dublin, California, confirmed that it had been hit June 29 by an attack that made it difficult for customers to access their financial accounts. Patelco forced its systems offline to contain the attack, which affected online banking services, the credit union’s mobile app and call center operations. Services such as wire transfers, direct deposits, balance inquiries and payment systems were then unavailable to customers.

Patelco said it is working with cybersecurity experts, law enforcement and regulators to respond to the incident. The credit union assured customers it would refund late payment fees incurred as a result of the outages. Patelco added it would write letters on behalf of customers about credit score concerns.

Customers were also advised that Patelco ATMs may continue to experience intermittent outages during the recovery process. “Currently, you can access your direct deposit funds by writing a check, using your ATM card to receive cash, or making a purchase,” Patelco wrote in a July 2 update. “We do not underestimate how severely this has impacted our members.”