CDK Global Outage: The Aftermath.

Nobody wants to hear it, but cyberattacks and ransomware are part of a complicated new reality for the digital systems supporting the auto repair industry. Are you prepared?

Months after the CDK Global outage ravaged the auto repair industry, there are still lingering effects and questions. This much is known: thousands of dealerships and shops relied on a software provider called CDK Global to power systems for ordering parts, tracking customer jobs, selling vehicles, and countless other daily tasks. Outages and issues for CDK Global customers were first reported on June 18th of last year, and it was later revealed that a cyberattack had immobilized CDK with ransomware. Dealerships and shops had to adapt or close their doors until those critical systems came back online. How did some shops persevere, and what lessons can be learned from them?

I spoke to employees at Bergey’s Ford of Lansdale, a local dealership that refused to throw in the towel when their systems went down. In fact, employees from across the business’ 14 locations had to adjust quickly, and in many cases, that meant solving new problems with solutions from the past.

Sales

Without CDK, thousands of dealerships were unable to list vehicles, complete sales, monitor inventory, or even advertise. “We went back to the old-school pen, paper, and calculators,” explains Bergey’s General Manager Scott Burkart. “We couldn’t access our inventory control information, and we couldn’t even create ads for the vehicles we had.”

Bergey’s worked to pivot from CDK-based systems to other third-party partners that were unaffected. Specifically, they needed platforms that allowed manual updates to inventory. This required the sales team to put in extra hours and work to restore the dealership’s presence online. Long-tenured staff trained others on how to use older paper processes to complete and track sales. These records were carefully stored so that data could be manually uploaded later once digital systems were back online. Without that continuity, a dealership would have yet another big problem to handle down the road.

Experienced employees teaching newer folks how to use alternate processes is a theme that you’ll see underpinning many of Bergey’s strategies. That legacy knowledge is valuable when hardening a business against modern problems, and it’s one of the most important lessons to learn here.

Finance

The outage introduced some particularly complex challenges for the finance side of the business, which was abruptly cut off from its most important systems and tools.

“There were a lot of unknowns at first,” recalls Burkart. “Many connections with partner vendors were cut to prevent intrusion into their own platforms. We now have reports that no critical information was damaged, but nobody knew then.”

Bergey’s moved to an inventory board to help keep all the details straight. How’s that for digital security?

“One of the things I was taught when I first started was the importance of the inventory board,” Burkart advises. “Much later, when we were remodeling, there was talk of removing our old board. But I like it because it always works, even when the power’s off, and we were glad to use it in this situation. We had customers’ vehicles coming in under the 21st century and leaving in the 20th,” he laughed knowingly.

Bergey’s staff relied on adaptability and a shared willingness to pull through to succeed. That sometimes meant learning new (or old!) roles or processes. Experience and a healthy dose of foresight ensured that the finance team anticipated problems down the line, including the highly detailed and critical work of keeping accurate records. Excel sheets, documented RO numbers, and careful notes meant that when CDK was back online, all the documentation could be backfilled.

“It was gratifying to see our team rise to that challenge,” says Burkart.

Technicians

Techs had plenty of their own issues to overcome, and other dealerships closing meant a spike in work that only added to the pressure.

“One of the first problems we had to solve was keeping track of the time our techs were spending on jobs,” says Production Manager John Edmonds. “With our systems down, we couldn’t look up the times for what they were doing. Service basically floated them hours because there was often no way to know how long each job would take.”

After the tickets were sorted out, they were adjusted and paid out. Learning how to properly handwrite a warranty documentation was a big obstacle because each ticket must accurately record the “story” of diagnostics and repair with specific language to avoid warranty denial. Stopping to revise a ticket slows the process down even further.

“We decided to go back to the old timeclocks with punch cards, but we discovered that ours didn’t work anymore. So we bought one and had it shipped in as quickly as possible,” Edmonds recalls.

Staff who’d used timeclocks for years showed the new folks how to use them correctly, and everyone worked to adapt to the past standard for recording time.

Service writers

Meanwhile, service writers had to learn how to get along without the usual systems. Simply contacting the customer, for example, was suddenly a problem. If customers didn’t include contact telephone numbers on the key drop forms or talk to someone before leaving, that could leave Bergey’s service department in a jam.

The same went for keeping track of payments from all the customers. Because credit card processing was linked to CDK, it couldn’t be safely accessed. Everything moved to manual recordkeeping, including handwritten estimates and a lot of detailed notes about customer contact information. When the dust settled at the end of the outage, their stack of ROs stood over a foot and a half tall… All of this, too, had to be backfilled later with total accuracy. Bergey’s recognized that things would eventually return to normal, and that would be an equally painful transition without reliable data. Would you think to do the same?

Parts counter

The situation wasn’t any sunnier at the parts counter. With the usual systems down, staff at the counter couldn’t look up parts, so they hit the books. Digital and physical copies of parts books kept the parts counter afloat during the outage. (Does your parts counter have current versions of those available?) Junior counter staff learned to get comfortable with finding and ordering parts that way.

“I’m all about processes,” Edmonds says. “Everything has to have a process that everybody understands. I’ve been doing this since 1986, and when I started out, everything was handwritten. Moving to digital was hard for a lot of staff at first back then. And we got to see the reverse of that with the CDK outage. So we made sure everyone was working with the same processes and understanding them… We have to work, so how do we move forward?”

Lessons for next time

Helpful senior staff, adaptability, accurate records, and manual backups all played major roles in keeping Bergey’s dealerships and business rolling through a challenge that caused others to close their doors. But there’s more to this story than backups, contingency plans, and employees with plenty of experience under their belts. When I asked Scott Burkart to describe the single most important contributor to Bergey’s successful navigation of this challenge, he immediately pointed to the collaboration and commitment that he saw from every part of the organization.

“We circled the wagons right away,” he says. “All of our stores continued to operate because we got together as a group and made an effective plan. That was implemented throughout the whole group. We are blessed to have phenomenal directors. And everyone got to work making that plan happen.”

The CDK outage attracted the attention of all kinds of authorities, including the Federal Trade Commission, law enforcement, cybersecurity watchdogs, and auto industry organizations. Investigations and input from these groups will likely lead to new security measures and protocols to protect the auto repair industry and its customers from similar attacks in the future. But businesses like Bergey’s will have more than that to rely on if (or when) a similar situation crops up again.

“Training for a problem like this could have been helpful, but it’s already hard enough,” says Burkart. “Communication is more important.”