Many dealers nationwide have experienced significant disruptions in business and outages due to a cyber attack on CDK Global’s dealer management system. At this point, it is too early to say what exactly happened over the last 48 hours, but it is being termed a significant cyber attack. The company voluntarily shut down its core systems in a cautionary move and attempted to restore most of them yesterday afternoon. As of this morning many dealer systems were still not operational.

It is not yet clear as to the extent of the intrusion or what data may have been compromised so the scope and a requirement to respond is not yet clear.  At this time, CATA Allied Member Assured Partners is advising all impacted dealers to report the breach to their cyber liability carrier to ensure timely reporting and response to the breach.

There are several coverages in the cyber liability insurance form that may provide protection for dealers impacted by the breach. One being Dependent Business Income loss triggered by a dependent system failure. It is a Privacy Breach, Security Breach or Administrative Error that triggers this coverage, and it appears that CDK Global is an Outsourced Service Provider who has experienced a Security Breach. In most cases the time element waiting period to for a dependent business interruption claim has expired triggering potential loss and restitution of loss income due to the outage to the dealers effected. 

As the scope of the breach unfolds and it is determined what if any customer data has been compromised, Privacy laws may require notification to any affected parties. Most cyber liability forms provide coverage for notification. Current review of the CDK contract to determine whether CDK or the dealerships will be responsible for complying with notification in accordance with state and federal privacy laws.

Assured Partners also anticipates that this event will be a recordable incident under the FTC Safeguards Rule. The CATA and Assured Partners will have additional guidance on this as the scope of the claim unfolds in the coming days. If you have any questions, you can contact Chris Schrementi at Assured Partners.