Cyberattack Affects Equipment Dealers

CRANBERRY TOWNSHIP, PA (DTN) -- Good news came on June 27 to the 21st Century Equipment dealership group, about 10 days after a cyberattack hit it and affected its customers.

The 26-dealer chain that sells and services John Deere equipment in eastern Colorado, western Nebraska and southeast Wyoming, had trouble starting around June 18. At first, the company's computer systems weren't working as expected. Things got worse the next day and were completely offline by the end of the week before finally coming back late this week.

"We're totally back," said Owen Palm, president and CEO of 21st Century.

The problem was part of a North American outage of services of CDK Global, the result of a ransomware cyberattack demanding millions of dollars against the company, which provides backend support for more than 15,000 auto dealerships across North America. Car dealerships in both the U.S. and Canada were hit hard by the outage. A J.D. Power estimate predicted new car sales numbers in the U.S. could be off by 100,000 in June compared with the same period last year, more than a 7% drop in volume.

FARM EQUIPMENT DEALERS AFFECTED

The damage went beyond automobile lots, and many farm equipment dealers found themselves struggling when the systems went down last week.

For automobile dealerships, the CDK system keeps customer records and takes care of much of the paperwork involved in the business, ranging from dealing with vehicle sales, to scheduling repairs, to handling payroll. Farm equipment dealers felt the biggest pinch in the parts department where systems that one day were automated suddenly weren't.

"This put a lot of them back in the file card stage and made everything manual," said Kim Rominger, CEO of the North American Equipment Dealers Association. "It became difficult for them to look up parts. All the parts and pricing are on computers, all the part locations, being able to do retailer orders, that's all been computerized and that was all effected."

The outage left many parts counters turning to pen and paper to write out invoices and had many an employee wandering through aisles looking for what a customer required.

"The dealers that had IT professionals on staff probably did a little better than those who didn't," said Rominger, "but it was a bad deal all around."

Some farmers and employees took to social media to highlight the problems, citing trouble finding parts or even accepting credit cards.

They were a little luckier than that at 21st Century. The company was able to use several other systems to duplicate much of the service it got from VitalEdge, a company formed from the heavy equipment division of CDK Global's operation, and one that proved vulnerable in the CDK attack.

A developer with Salesforce, another retail management software company, helped patch the holes for 21st Century, and the company used ExpertConnect from John Deere to continue taking payments.

It took some time to enter in all the transactions and information when the system came back on late this week, but all in all, Palm was happy with how his dealerships weathered the storm.

PREPARING FOR THE NEXT CYBERATTACK

The next goal, in Palm's eyes: Be ready for the next one.

"We need to be prepared," he said. "If CDK can get hacked, anyone is probably vulnerable, so we need to tighten our security up even more. It took us a couple of days to react this time and get Salesforce working. We need to maintain that interface and be able to react quicker to an alternate system the next time."

That's part of the message Rominger is sending out to member dealers in his organization. This issue didn't arise because of a security lapse among his dealers, and there's likely nothing they could have done to prevent it. It still should stand as a warning to how vulnerable a business can be, and how important it is to be prepared.

"With the world we live in today, there are a lot of dangers and bad problems that can happen to a dealer," Rominger said. "I can guarantee you companies will be looking at this and trying to figure out how to resolve this ahead of time to protect themselves."

Joel Reichenberger can be reached at Joel.Reichenberger@DTN.com

Find him on social platform X @JReichPF

(c) Copyright 2024 DTN, LLC. All rights reserved.