Wisconsin auto dealerships revert to paper and pen during ransomware attack

Nearly 160 Wisconsin auto dealerships still face disruptions from the ransomware attack against software provider CDK Global, which handles much of their paperwork.

Nationwide, around 15,000 dealers have been affected by the attack that’s believed to have originated in Eastern Europe. CDK, one of the largest providers of cloud-based software to dealers, helps them manage vehicle acquisitions, sales, financing, parts ordering and scheduling vehicle service.

A group that claims it hacked the suburban Chicago company has demanded tens of millions of dollars in ransom, Bloomberg Business News reported, citing a person familiar with the situation. CDK intended to pay the ransom, but discussions were subject to change, according to Bloomberg.

CDK shut down most of its systems “out of an abundance of caution” for dealerships, said spokesperson Lisa Finney.

In Wisconsin, 159 auto dealers have been affected by the CDK hack and shutdown, according to the state Division of Motor Vehicles. The shutdown has caused some of them to revert to old-fashioned paper sales forms and completing documents by hand.

“Ultimately, they’ll still have to input all that information to CDK once they’re back and running, so that all the accounting gets squared away,” said Jim Tolkan, president of the Automobile Dealers Association of Metro Milwaukee.

“They can still do business,” Tolkan said, provided that dealers can obtain the paper forms.

The attack against CDK began last Wednesday. Despite attempts to restore services, another attack that evening caused further disruptions. It's still unknown when services will return to normal.

On its website, CDK says it provides a "three-tiered cybersecurity strategy to prevent, protect and respond to cyberattacks."

June is one of the stronger months for vehicle sales. If there are delays handling paperwork, the CDK outage could cost some dealerships sales, or at the least, a paperwork headache.

Wisconsin's Division of Motor Vehicles says it’s provided an alternative for dealers to continue processing title applications and issuing temporary plates.

“The customer impact is minimal. In situations where the dealer would normally provide a permanent plate at the time of sale, they may now only provide a temporary plate. The plate/registration will be mailed directly to the customer from DMV,” the agency said Monday in a statement to the Journal Sentinel.

The cybercriminals behind the attack are linked to a group called BlackSuit, according to Bloomberg.

In May, a cyberattack against Ascension hospitals and clinics in Wisconsin and across the country reportedly involved a type of ransomware called Black Basta, according to CNN, which cited four anonymous sources.

Black Basta is a type of ransomware used to encrypt victims' computers, rendering them unusable. Hackers can then extort victims by demanding money in return for access to the computer systems.

USA Today contributed to this report.

This article originally appeared on Milwaukee Journal Sentinel: Wisconsin auto dealerships revert to paper and pen during ransomware attack