Archive for June 23, 2024

CDK Global Was Pwned By BlackSuit Ransomware: Report

Posted in Commentary with tags on June 23, 2024 by itnerd

You might recall that thousands of car dealerships have been shut down by their SaaS provider CDK Global not being available to them. Now BleepingComputer is reporting that a ransomware group called BlackSuit is apparently responsible for all of this:

The BlackSuit ransomware gang is behind CDK Global’s massive IT outage and disruption to car dealerships across North America, according to multiple sources familiar with the matter.

The same sources, who provided information on condition of anonymity, told BleepingComputer that CDK is currently negotiating with the ransomware gang to receive a decryptor and not leak stolen data.

While BleepingComputer is the first to report that BlackSuit is behind the attack, the news that CDK is negotiating with threat actors was revealed by Bloomberg yesterday.

If this is true and CDK Global is actually in negotiations with BlackSuit, then that’s bad. I’ve been consistent in saying that threat actors should never profit from their crimes. So by extension, negotiating with threat actors is bad. I guess we’ll find out if this is true or not if dealerships across the US are suddenly able to conduct business normally in the coming days.