CDK Global Suffers Multiple Ransomware Attacks in June

• •CDK Global suffered two ransomware attacks in June 2026, disrupting dealership operations.
• •The BlackSuit ransomware gang claimed responsibility for the initial breach on June 18.
• •Threat actors are posing as CDK support agents to gain unauthorized access to customer systems.

CDK Global, a software vendor for car dealerships, experienced a ransomware attack on June 18, 2026, which forced the company to shut down its systems to contain the breach. As CDK began to restore its services, it was hit by a second attack on June 19, disrupting operations for numerous dealerships reliant on its platform. The BlackSuit ransomware gang claimed responsibility for the initial attack, which also affected local governments and schools, causing significant operational disruptions. CDK Global's spokesperson confirmed that the company took proactive measures to protect its customers, including shutting down most systems and warning customers about threat actors posing as support agents. The ongoing recovery efforts have left many dealerships unable to conduct normal operations, and CDK has set up alternative communication channels for customer updates. The situation remains fluid as CDK works with cybersecurity experts to assess the impact.