CDK Global pays $25 million worth of Bitcoin as ransom to end cyber attack

Last month, CDK Global experienced a significant cyberattack, disrupting software at approximately 15,000 US car dealerships. This event showcases the increasing threat posed by ransomware groups targeting large organisations.

Ransom Payment

According to blockchain analyst ZachXBT, CDK Global paid 387 BTC to the ransomware group BlackSuit on June 21. The payment, reportedly aligned with a Bloomberg report, aimed to prevent public data release and expedite system recovery. However, CDK has not confirmed the ransom payment, only announcing that nearly all affected dealerships are now back online.

CDK CEO pledges to compensate dealers after ransomware event

CDK CEO Brian MacDonald promised dealers in a letter that they would receive "some financial relief" for interruptions stemming from the June 19 cyberattacks.

Ransomware incidents are common

Ransomware involves deploying malware to restrict access to computer systems or data, with demands for ransom, usually in cryptocurrency, for their release. Chainalysis reported that ransomware payments in 2023 have nearly doubled, reaching over $1 billion. This reflects the growing prevalence and sophistication of ransomware attacks.

BlackSuit situation

BlackSuit, a notable ransomware group emerging in 2023, has targeted US companies, including CDK Global. Other groups like cl0p and Black Basta have extorted millions, exploiting vulnerabilities in software systems. These groups often launder ransom payments through sanctioned exchanges, complicating tracking efforts.

The CDK Global case has huge impact

Federal agencies like the FBI have issued advisories in response to the rise in ransomware attacks. They recommend regularly patching and updating software, as well as conducting vulnerability assessments to mitigate risks.

While CDK Global's situation highlights the urgent need for robust cybersecurity measures, the broader industry faces challenges in keeping pace with increasingly sophisticated ransomware threats. Regulatory efforts and enhanced security protocols are crucial in combating these persistent cyber threats.