Skip to content
Close
SEARCH
Join NHADA
Join NHADA
Dealership_Hero

JOIN OUR COMMUNITY

NHADA Supports the Success of Over 500 Motor Vehicle Businesses
BECOME A MEMBER
UPDATES
Smiling employee's in a line at work

Explore Cost-Effective Insurance & Workers' Comp. Plans

Get a free Quote
REPORT AN INJURY ONLINE (FORM 8-WC)
Association Events
Learn about NHADA's major events and fundraisers.
VIEW ALL EVENTS
UPCOMING EVENTS
INDUSTRY TRAINING
Explore upcoming webinars, seminars, and on-demand training.
VIEW ALL TRAINING
UPCOMING TRAINING
ON-DEMAND TRAINING

Off the Clock Video Series

Explore the fascinating lives of automotive professionals in our new video series, "Off the Clock"

FREE PARTNER OFFERS
ALL OFFERS
Compliance/Industry Guides
VIEW ALL GUIDES

Can't find what you're looking for? Try one of NHADA's partners.

LotDrop-Nav_Supplies

Forms & Supplies

Start Shopping

LotDrop-Nav_Apparel

Corporate Apparel

Start Shopping

LotDrop-Nav_Promo

Promotional Items

Start Shopping
cdk data breach
ComplyAutoJun 21, 20241 min read

CDK Incident Sparks Phishing Scams - Reports

Scammers Taking Advantage of CDK Incident 
As ComplyAuto previously warned about, CDK customers should be aware of bad actors attempting to take advantage of the CDK incident, including via potential 'bandwagon' phishing attempts. Reports have emerged stating that bad actors are sending communications falsely claiming to be CDK employees who can help get dealerships back online. Dealer employees should be aware of these phishing attempts in order to protect the dealer's accounts and systems from these secondary bandwagon attacks.

Data Breach Reporting Refresher
In this video, ComplyAuto's Brad Miller addresses questions received from numerous dealers about their potential obligations if it is determined that customer data has been breached. Note that as of the time of publication on June 20, 2024, there is not currently any evidence that suggests consumer data was compromised as part of the CDK incident.

Dealer reporting obligations under state and federal law

PARTNER SPOTLIGHT

Here is a brief summary of the points Brad discusses

  1. Potential reporting under federal regulations
    -   FTC recently amended the Safeguards Rule to include a requirement to report to the FTC any "notification event" (commonly referred to as a "breach") involving 500 or more customers' unencrypted data as soon as possible, and no later than 30 days after discovery of the event.
    -  Dealer must report the breach even if it happened at a vendor.
    -  FTC reports are public information.
  2. Potential reporting under state law
    -   Definitions, timeframes, and reporting thresholds differ among the states.
    -   State laws often require a dealer to provide customer notification, and a dealer may also have to notify a state agency.
    (Check out the ComplyAuto breach reporting wizard tool for more information.)
  3. Business Interruption Insurance Coverage
    Dealers whose operations are impacted by the CDK systems being down might consider exploring whether they have business interruption coverage under any of their insurance policies that could provide relief for expenses and losses arising from the interruption in business resulting from the outage. Each insurance policy is different and historically business interruption coverage was associated with physical casualties (e.g., fire damage), but in recent years some cyber insurance policies have included business interruption coverage. 
avatar

ComplyAuto

RELATED ARTICLES