In the past several years, dealers have had to deal with a plethora of disruptions to their businesses, including COVID-19, supply chain issues, semiconductor chip shortages, and now cyberattacks. On June 19, 2024, CDK Global, Inc. (“CDK”), a dealership DMS provider holding a majority of its relevant market share, was brought to its knees by ransomware cyberattacks. Out of an abundance of caution, CDK took all of its systems offline, significantly disrupting the operations of more than 15,000 dealerships across North America. On June 21, 2024, Bloomberg News and Reuters reported that Blacksuit, a well-known cybercriminal team, was behind the ransomware attack.

As of the date of this article, the core functions of CDK are back online with the exception of certain third-party applications. CDK has been very careful about what details it shares with the public about the cyberattacks—presumably to protect itself from forthcoming litigation. While insufficient confirmed facts prevent full analysis at this time, the discussion below may provide helpful information to dealers concerned about preserving, and understanding, their rights under these circumstances.

Litigation against CDK

Given the devastating effects of the CDK ransomware attack, it is no surprise that there have been numerous lawsuits filed against the DMS software provider. As of the date of this article, dealerships, dealership retail employees, and consumers are among the plaintiffs in the 10 federal lawsuits filed against CDK. Allegations in these lawsuits include negligence, negligence per se, unjust enrichment, contractual breaches, and breaches of fiduciary duty.

There are currently two separate ongoing cases involving dealerships. The first lawsuit involves a Mississippi based Buick-GMC dealership that alleges that the dealership was not able to conduct regular business, thus causing significant business interruption and lost revenues. The second lawsuit involves a multi-dealership lawsuit alleging CDK was negligent in protecting its users and stating that sensitive personal data was shared with cybercriminals, causing those dealerships to suffer reputational damages. Both lawsuits request their respective courts allow class-action status to be applied to their cases, varying slightly in how the respective classes are to be defined, but both having the overall theme of businesses that suffered losses from the cyberattacks.

As of the date of this article, CDK has not filed a response to any of the complaints filed, but it is anticipated their responses to these lawsuits will provide critical details on the data privacy and security controls that were in place when the cyberattacks occurred. How adequate those privacy and security controls were will likely be the dispositive issues in these cases.

CDK Master Services Agreement

Although potentially customized and of a different vintage for each dealer, we looked at a copy of CDK’s Master Services Agreement (the “MSA”) to see how it addresses CDKs privacy and cybersecurity obligations and liability. Language in the MSA requires CDK to maintain reasonable security measures to prevent unauthorized access to, or loss or alteration of, dealership client data and to protect dealership client data consistent with applicable state and federal laws. However, importantly, the MSA explicitly states that CDK does not guarantee against any unauthorized access or loss of dealership client data. As such, it is anticipated that analysis of CDK’s contractual liability will focus heavily on whether CDK maintained “reasonable security measures” to prevent cyberattacks.

Even if CDK were to be found in breach of its safeguarding obligations under the MSA, pursuing damages is further complicated by the limitations on liability provisions in the MSA. For example, the MSA provides that CDK would, regardless of the legal claim, be liable only for the lesser of either (1) the amount of actual damages incurred by the dealership or (2) an amount equal to one month’s average monthly payment to CDK averaged over the prior 12-month period. The MSA also contains language that CDK would not be responsible, under any circumstances, for loss profits or interruption to a dealership’s business, especially those that are out of CDK’s reasonable control. While an analysis of whether the cyberattack was outside of CDK’s reasonable control requires additional factual information not yet made available, CDK has an arsenal of liability-reducing protections in the MSA.

Moreover, the MSA contains a mandatory arbitration clause with an Illinois choice of law. Whether the arbitration clause is subject to attack or is not applicable for certain claims remains to be seen. However, claims that are subject to arbitration generally cannot be pursued on a class action basis.

Liability limitations

Whether a particular contract is categorized as one for the sale of goods, versus the sale of services, has substantial implications on the enforceability and interpretation of many provisions of a contract. Whereas Article II of the Uniform Commercial Code (the “UCC”) governs the sale of goods, common law generally governs the sale of services. Whether CDK’s DMS product is categorized as a good or service may affect the enforceability of limitations of liability in the MSA.

The UCC provides that limitation of liability provisions, like the one discussed in the MSA above, can be found unenforceable if the contract “fails of its essential purpose.” Therefore, assuming the court finds CDKs DMS product to qualify as a good, dealerships may have remedies like incidental and consequential damages (i.e. lost profits) available to them—regardless of any contradicting language in the MSA—since the essential purpose of the product, the DMS, was completely unavailable to dealers. Under common law, significantly more deference is given to the actual language in the underlying agreement between the parties and that language will generally not be circumvented unless the contract is found to be unconscionable. Even then, deference is subject to being eliminated or reduced based upon a variety of factors, including whether any statutory or regulatory provisions impinge on the services being offered. Here, the plethora of existing state and federal privacy and data security laws – and the public policies they serve – will certainly be important to factor into the analysis.

Generally, a predominant purpose test is used to determine whether a contract is interpreted to be one for the sale of a product or a service. Many factors are taken into account, and prior court precedent is taken into consideration. Interestingly, in an earlier court battle, where CDK was facing antitrust allegations, a court declined to find that the CDK DMS product was a “good” (In re Dealer Management Systems Antitrust Litigation (N.D. Ill. 2019) 362 F.Supp.3d 510, 550), so this issue is far from settled.

Compliance with California Law

In apparent recognition that dealers cannot run their businesses in compliance with applicable privacy and cybersecurity laws without the proper operation of their DMS systems, and do not have the bargaining power to support a presumption that DMS contracts are fair and balanced, California enacted Vehicle Code Section 11713.25, which provides as follows:

Note that subsection (a)(1) effectively requires each DMS provider to maintain administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of the information. It would be surprising if a court read this provision to allow anything less than “reasonable” safeguards to satisfy CDK’s obligation.

Note also that subsection (a)(3) bans efforts by the DMS vendor, even contractual efforts, to limit the dealer’s ability to maintain its data security. The last sentence of subsection (a)(3) also appears to prohibit waivers of the duties of the DMS vendor under subdivision (a) of section 11713.25. These anti waiver provisions could be asserted to negate limitation of liability provisions contained in CDK agreements. Research will determine whether similar arguments might also be made based on provisions found in federal statutes and in the laws of other states.

It is hoped that more information about how CDK’s system was penetrated and the extent of any data breach or loss will soon become available. In the meantime, it may behoove dealers to refrain from accepting any “compensation” from CDK unless accompanied by an express reservation of all rights signed by CDK. At the same time, dealers would be well served to keep good business records regarding any losses, costs, or expenses they incurred by reason of the CDK outages.