CDK requests dismissal of combined collision repair lawsuit after cyber attack

A year post a cyber attack on CDK, several lawsuits are in progress, including complaints from collision repair businesses that suffered the consequences. In February, multiple complaints from auto body shops and vehicle brokers were merged into one lawsuit against CDK in the Northern District of Illinois. The plaintiffs in this case include Jay Kay Collision Center, East McComb Body Shop, Formula Sports Cars, Bill Holt Chevrolet of Blue Ridge, DLR Auto Group, Smith Collision Center, and Broadway Precision Collision. These entities were amalgamated into a complaint originally instigated by Jay Kay Collision Center in June 2024. Smith Collision Center and Broadway Precision Collision followed suit by filing a joint lawsuit about a month later.

During this predicament, CDK had to halt its management system, affecting approximately 15,000 dealerships in mid-June 2024. This system encompassed a range of tools such as vehicle sales, financing, insurance, parts inventory, and order placement. The complete shutdown lasted for several weeks, inconveniencing many businesses for even a more extended period. Jay Kay’s lawsuit alleges that CDK’s inadequate implementation of data security measures led to a data breach, disrupting operations of car dealerships, repair shops, OEMs, software vendors, and other service providers. It accuses CDK of negligence, breach of contracts, and unjust enrichment. The complaint states that the outage caused delays in crucial business functions, disruptions in operations, substantial costs in finding temporary solutions, and potential exposure of sensitive personal and financial information to unlawful individuals.

In a recent development, CDK has filed a motion to have the consolidated complaint dismissed. The company argues that the negligence claim made by the plaintiffs is invalid because these businesses are downstream entities and not CDK’s direct clients. Judge Jeffrey Cummings has scheduled a hearing on this motion for September 19. A report from Automotive News reveals that the CDK lawsuits have been consolidated into two broader cases – one covering the collision industry, which includes businesses beyond dealerships, and another for individual dealership cases. The majority of those who initially filed lawsuits against CDK have retracted their claims, states Automotive News. Additionally, individuals such as dealership customers and employees have also lodged lawsuits against CDK, seeking to convert it into a class-action lawsuit.

Auto News reflects on the legal situation a year post the incidents at the U.S. Northern District of Illinois. It notes that most dealership lawsuits have been withdrawn or settled through arbitration with CDK. Similarly, some people who accused the dealership management system provider of compromising their data have also dropped their claims. The legal scenario is beginning to clear up, with just over a dozen individuals pursuing class-action cases against CDK. By and large, the aftermath of the cyber attack has triggered a series of legal actions, with businesses and individuals asserting damages caused by the disruption and breaches in data security.