Lessons Learned

The popular saying, “There’s no ‘I’ in Team,” came into play as dealers navigated this summer’s CDK Global software outage following a cyberattack, says Stephanie Cooper, an account executive and trainer with iA American Warranty Group.

It took a team effort to help dealerships operate after their CDK systems went down, she pointed out.

Initially, many dealerships felt paralyzed, unsure how they could sell cars without the technology they usually rely on. The situation forced dealerships and the companies that serve them to get back to basics, according to Cooper.

The industry veteran remembers arriving at a customer's dealership soon after the attack and finding a defeated atmosphere.

“When I asked what had happened, they said, ‘CDK went down, and we can’t sell cars,’” she says. “I was like, ‘Why not? That’s one system out of several that you have.’”

Yet, she says, all that stood out to them was the absence of inventory access, the inability to calculate payments online, and the inability to push deals.

Rather than submitting to their worst fears, Cooper and dealership personnel gathered to develop solutions. Automotive retail constantly adapts to changing processes, laws and economic conditions. The disruption should have been viewed as just another problem to solve, she says.

Cooper quickly organized a team to help dealerships adopt innovative workarounds and F&I techniques.

The team, consisting of dealership employees and industry partners, brainstormed solutions. Everyone, she says, pitched in to get it figured out.

According to Cooper, the disruption’s silver lining was that spirit of collaboration.

“Everyone came together to find solutions, and everyone’s voice and opinion was heard. There were sales managers pitching in to help finance managers. Industry competitors worked together to help dealerships. I am immensely proud of the teamwork I saw.”

A Snapshot of the Situation

On June 19, CDK Global, a major software provider for U.S. car dealerships, experienced a ransomware cyberattack that made headlines.

The resulting outage disrupted operations, sales, scheduling and orders for thousands of CDK-dependent dealerships.

Most of the company’s nearly 15,000 dealerships in North America regained access to their systems by July 4. In the meantime, they needed a new way of doing business, according to Garrett Thorpe, president and CEO of The Impact Group.

The entire industry had to collaborate to help dealers operate, Thorpe says.

“We had to work together to streamline processes until CDK came back online. And we had to ensure there was no duplication of data once CDK systems were restored.”

The difficulty was that no one, not even CDK, knew how long it would be until systems were restored. "We had to streamline communication for status updates," Thorpe says. “And in the meantime, we had to do what we could to keep dealerships functioning and prevent issues as systems were restored.”

The company also saw the need for immediate training. According to Thorpe, both seasoned and younger professionals faced a learning curve because of their heavy reliance on technology for sales and F&I.

“We had to educate everyone on how they could still deliver a car and do it without their [dealer management system],” he says. “The industry accomplished this by getting back to basics on the training side.”

Compounding Concerns

The primary concerns involved desk accuracy and correctness without a DMS, Thorpe says.

The Impact Group made its software solutions, typically used only by finance-and-insurance managers, also available to sales managers so they could accurately calculate lease and loan payments, he says.

iA American also jumped in with training to help employees continue conducting business and perform other core processes without a computer, including working deals, contracting deals, and keeping customers satisfied despite a slowdown in processes.

“We walked through what was necessary to do this, which was an enormous challenge,” Cooper says. “I reached out to menu providers, Dealertrack, RouteOne, and others to see what they could do to help dealerships get over this hurdle.”

All of the companies lent a hand, she says, and adherence to regulations was top of mind through all of the efforts.

“If they were e-contracting, for example, we needed to make sure they were still legal and in compliance. We also worked with our legal team and others to make sure the advice we gave wasn’t out of compliance. It was vital that we made sure dealers maintained compliance during this time.”

A primary concern was also making sure the customer experience stayed high-quality, Cooper adds. “We wanted to help them function in a way that the customer would not see a hiccup. We made sure they communicated proactively with customers and asked for patience, and soon everyone understood.”

The industry also worked together to keep morale high, especially in stores drastically affected by the outage. “It slowed things down because they had to do everything by hand, but it also gave them an opportunity to relearn the fundamentals, and why they follow and do those processes in the first place,” Cooper says.

Post Restoration Efforts

After restoring CDK systems, dealerships were left wondering about their next steps. After all, they had manually entered data into separate systems.

“Now deal records existed in a vacuum, in the F&I system, without DMS integration,” Thorpe says. “So we had to figure out how to get information back into the DMS.”

The Impact Group helped dealers compile data on transactions made during the outage and provided them with a dataset to reconstruct those records in their DMS.

“This was a heavy lift. We had to give dealers what they needed to reconstruct their business and make sure it finally ended up in their DMS. We also needed to make sure that when the DMS came back online, there was no overlap of information.”

That required industry players to write code that would prevent duplicate data.

Dealers expected to regain access to all systems when CDK came back online. “That did not happen,” Thorpe says. “They thought when they regained access to the DMS, integrations with other systems, such as [customer resource management] system or other third-party software, would also be restored. They were not. Instead, there was a rolling reactivation of assorted services, with the DMS coming back online first.”

CDK and other industry partners had to help dealers understand the process and when it would get resolved. They also had to help dealers prepare for the change and provide guidance on managing data flow.

“This required us to control the flow of information so that everyone was on the same page, because it was chaos for two and a half weeks,” Thorpe says. “It also required a lot of manual entry. We had one dealer group that delivered 2,000 cars while CDK was down. The reconstruction effort was tremendous, and all that data had to be manually entered back into CDK.”

It was all hands on deck, adds Cooper, who says iA American postponed training events in order to help challenged dealerships.

“Our role is developing skills and reinforcing processes. During this time, it was important we show up not to train but just to be there for our stores. As a team, we jumped in and asked, ‘What can we do. How can we help.’”

The lessons learned were significant. Companies such as The Impact Group and iA American discovered what their customers needed during a crisis. Dealerships realized their industry partners were there for more than just selling software tools or providing training.

“Our clients learned to adapt, and we learned that sometimes the best thing we can do is just show up and help,” Cooper says. “This is a human business, not just a car business.”

The Silver Lining

The company executives pointed out the oft-repeated truth that in every challenge, there are opportunities, and in this situation, many positive things have emerged, according to Cooper.

A key lesson for dealers was that they can still operate and deliver cars when systems are down.

“We’ve become so reliant on this one core system that does so much,” Thorpe says. “But you can still do transactions in a more isolated way. You can present a buyer’s order and have that signed. You can locate a title app and get a title produced. You can still present F&I menus. You can still write a bank contract and deliver a car. These are all components that CDK helps with, but that doesn’t mean they don’t exist anywhere else.”

Dealerships now understand the need for an action plan if such an outage happens again, and Thorpe says that’s likely.

“The attack on CDK was a successful attack. Someone profited greatly from it, which suggests it will occur again. Dealerships must be ready.”

His key recommendation is to not wait for another attack but to develop an emergency plan with a list detailing the steps to take.

“Reflect on the core processes that must remain operational on the sales and service side. Another aspect of this is to know who to call and in what order when a disruption occurs. How do we connect with our partners if this happens again?”

He also recommends developing best practices for manual entry. That should involve training everyone on the fundamentals so they understand the deal structure and calculations, and learn to triple-check, the data.

Cooper says iA American will emphasize the fundamentals in its training. Dealerships may rely on technology every day, but they must “know the inner workings of a car deal and be ready to work it without a system,” she agrees. “That’s probably the biggest lesson that came out of this. Everyone learned that sometimes you have to slow things down to speed things up.”

Manual calculations might contain errors, Thorpe points out. However, unless the errors result in lower payments for customers, there may be less incentive during a catastrophic outage to completely redo the paperwork, he says. The dealership will have to deal with the consequences of the mistakes, so it's better to develop good habits to avoid them.

It’s also important to consider cybersecurity insurance, Thorpe adds. Whether the company is a service provider or a dealership, having enough financial protection in case of a cyberattack is crucial.

“Make sure you have financial protection for a potential loss of business after a cyberattack and have an action plan for what will happen in the aftermath.”

Proactive versus reactive management is needed to be ready for the next attack to save time, money and maintain positive customer experience, Cooper says. “You cannot predict when the next event will happen, but you can be ready for it.”

Ronnie Wendt is an editor at Agent Entrepreneur.