A year after a ransomware attack on CDK, multiple lawsuits continue to move through federal court, including complaints raised by collision repair businesses. 

In February, a federal judge consolidated complaints from auto body shops and vehicle brokers into one suit against CDK in the Northern District of Illinois. 

Plaintiffs in the case include Jay Kay Collision Center, East McComb Body Shop, Formula Sports Cars, Bill Holt Chevrolet of Blue Ridge, DLR Auto Group, Smith Collision Center, and Broadway Precision Collision. 

The plaintiffs were consolidated into a complaint originally filed by Jay Kay Collision Center in June 2024. It was the first suit filed by a collision repair center. Smith Collision Center and Broadway Precision Collision filed a similar joint suit about a month later. 

CDK first shut down its management system to 15,000 dealerships in mid-June 2024. The system provides a suite of tools, including vehicle sales, financing, insurance, parts inventory, and ordering. A full shutdown lasted weeks, with some businesses saying they were impacted longer. 

Jay Kay’s suit claimed CDK failed to implement reasonable data securities causing a data breach that disrupted service to car dealerships, automobile repair centers, OEMs, software vendors, and other service providers. It claims CDK acted in negligence, breached contracts, and was unjustly enriched. 

“The outage has caused a delay in critical business functions and disruption to businesses, inflicting substantial costs to develop workarounds, and has potentially exposed their sensitive personal and financial information to criminals,” the complaint states. 

Last month, CDK filed a motion to dismiss the consolidated complaint. The company alleges that the plaintiffs’ negligence claim fails because the companies are downstream businesses that are not customers of CDK. 

Judge Jeffrey Cummings has set a hearing on the motion for Sept. 19. 

Automotive News recently reported that CDK lawsuits have been consolidated into two umbrella cases — the collision industry suit, which includes businesses that are not dealerships, and another for individual dealerships. 

Some of those who brought suits against CDK have dropped their claims, Automotive News says. 

“One year later, the legal landscape for the numerous cases brought to the U.S. Northern District of Illinois is beginning to clear,” the article says. “All of the dealerships have dropped their lawsuits or entered arbitration with CDK. Some of the people who accused the dealership management system provider of compromising their information have dropped their claims.”

More than a dozen individuals, such as dealership customers and employees, have also sued, Automotive News says. It adds that the plaintiffs are seeking to make the lawsuit a class-action case.

Images

Photo courtesy of BalkansCat/iStock