CBS News
CDK Global faces multiple lawsuits from dealerships crippled by cyberattack
CDK Global faces at least eight lawsuits from auto dealerships over cyberattacks that took down the software provider’s dealer management system, crippling car sellers’ operations.
The plaintiffs, who are employees or customers of car dealerships that use CDK tools, allege CDK did not adequately protect customer data and that the personal information of tens of thousands of people was likely exposed in the hack.
Tucson, Arizona-resident Omar Aviles, an employee of Asbury Automotive Group, one of CDK Global’s roughly 15,000 clients, has filed a proposed class-action suit against the Illinois-based company, alleging it failed to protect the “litany of highly sensitive personal identifiable information” it had stored about former and current auto dealership clients and their customers and employees.
The trove of data was exposed due to CDK’s “insufficiently protected computer systems,” according to the complaint, filed in district court in Illinois.
On its website, CDK touts its cybersecurity capabilities, promising to “stop cyberattacks in their tracks.”
“CDK Cybersecurity Solutions provide a three-tiered cybersecurity strategy to prevent, protect and respond to cyberattacks so you can defend your dealership,” the website states.
Social Security numbers exposed
The suit, by contrast, claims that CDK “had no effective means to prevent, detect, stop or mitigate breaches of its systems — thereby allowing cybercriminals unrestricted access to its current and former clients'” personal data. That data includes Social Security numbers, employment history, driver’s license info, financial account details and more.
The security failure stems from CDK’s inadequate training of its own employees on on cybersecurity, the lawsuit claims. As a result, Aviles “fears for his personal financial security and worries about what information was exposed in the data breach” and is suffering from “anxiety, sleep disruption, stress, fear and frustration.”
The collection of suits are seeking damages, as well as for CDK to better protect customer information.
“It’s a disaster”
A second lawsuit from a group of dealers including Formula Sports Cars, Prestige Motor Car Imports, Bill Holt Chevrolet of Canton, Bill Holt Chevrolet of Blue Ridge and a pair of consumers, also claims CDK was negligent in protecting its clients. “CDK has failed to uphold its promises and responsibilities that it made throughout the course of its marketing campaigns making users feel at ease,” the suit states in part.
“It’s a disaster,” said one affected dealer quoted in the lawsuit, in describing the toll of the breach on his business. “Customers are coming in, we’re selling cars, but we can’t book the deals, can’t finance the deals or get them to the banks. Which means we cannot fund the cars or pay off the cars,” he said.
Like stitching up a wound without cleaning it
After CDK was first breached, it restored its systems, only to be hacked a second time. In their suit, the dealers compare CDK’s decision to restore systems without resolving underlying security issues to “a doctor stitching up a wound without first removing all the debris.”
“Just as a wound not properly cleaned would lead to more infections and prolonged healing, CDK’s rush to restore its system led to more breaches and, in turn, left car dealerships exposed to financial losses for longer periods of time,” the lawsuit states.
CDK has not indicated if it will compensate affected dealerships for any financial losses or potential exposure to identity theft as a result of the cyberattack. A spokesperson for the company did not immediately respond to CBS MoneyWatch’s request for comment on the lawsuits.
CBS News
Racist texts sent to random Black Americans in multiple states, FBI investigating
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.
CBS News
Mountain Fire has now burned over 20,000 acres north of Los Angeles
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.
CBS News
Police-style handcuffs on Texas murder victim made investigators fear the killer was among them
On Jan. 14, 1995, Mary Catherine Edwards, 31, a beloved elementary school teacher, was found dead in her townhouse in Beaumont, Texas.
Her parents found her. It was a terrible scene: she was in her bathtub, handcuffed, and had been sexually assaulted. There were no signs of forced entry, which made investigators think she must know her killer. The police-grade Smith & Wesson handcuffs were always a big clue, but when detectives tried tracing the serial numbers, they came up empty. Early investigators questioned various law enforcement officers and came up with nothing either.
The case went cold, but as Beaumont police Det. Aaron Lewallen told “48 Hours” contributor Natalie Morales, “It was almost talked about like a ghost story around a campfire. Could it have been somebody that we knew?” Morales reports on the search for answers in “Tracking the Killer of Mary Catherine Edwards,” airing Saturday, Nov. 9 at 10/9c on CBS and streaming on Paramount +.
Thanks to carefully preserved DNA from the crime scene and the advent of genetic genealogy, Det. Aaron Lewallen, his wife Tina Lewallen, also a detective — along with Brandon Bess, a Texas Ranger in the cold case division, and Shera LaPoint, a professional genealogist — spent almost three months working together in a nonstop push to finally solve the case.
After all the early leads and the suspicion that someone in law enforcement had been involved, the family tree they constructed revealed someone else. Their chief suspect turned out to be not a law enforcement officer, but a man who went to the same high school as Edwards: Clayton Foreman.
And then they learned that Edwards and her identical twin sister Allison had been bridesmaids in Foreman’s first wedding. The sisters were good friends with his first wife, Dianna Coe, who also went to the same high school.
Coe remembers them fondly, telling Morales how kind they were to her when she moved to a new town and started a new school.
“I was new to the area … so, I knew no one. And they … just started talking to me and asked me my name … and we were friends from that point forward,” Coe said.
The sisters were the first people Coe thought of to be bridesmaids at her wedding. She and Foreman stayed married for 11 years. They were divorced by the time of the murder, but in hindsight, Coe began to see things in a different, darker, light. She remembered her ex-husband’s fascination with the police officers and their tools of the trade, like handcuffs and billy clubs. As Coe told Morales, “He had a billy club that he kept…by the bed. You know, said it was for protection. And I remember that he had ordered those handcuffs…Well, he had them hung over the rearview mirror.”
Coe also remembered a disturbing conversation with her ex-husband when she heard Edwards had been murdered and called to talk about it.
“I think I was, you know, crying and I said, ‘oh, my God,’ I said, ‘somebody has murdered Catherine,” Coe told “48 Hours.” “And — and he goes, ‘Oh, really?’ Just like no emotion, which I thought that was odd.”
A DNA match quickly established that Foreman had indeed been at the crime scene. And when Det. Aaron Lewallen and Ranger Bess went to question Foreman, they had an arrest warrant. They also brought something with them — something very symbolic.
Together, they had taken the time to work out an arrangement with the prosecutors so they could use the handcuffs taken as evidence at the crime scene. When they arrested Foreman for the murder of Edwards, they did so with the very handcuffs that had bound her the night she died. He wasn’t one of them, but in the course of the investigation, they learned Foreman had been falsely claiming to be a police officer.
The handcuffs — such a focus in the beginning — came full circle at the end. Bess will never forget how it felt. As he told Morales, “It’s a moment I’ll never forget…you feel like you got to do something for Catherine there…You know, like physically got to do for her, is take those cuffs that bound her when she was murdered and put them back on the guy that murdered her…It may seem small to some, but it was a really big deal to us, and it felt good.”
The jury in Foreman’s murder trial deliberated for less than an hour before finding him guilty of the murder of Edwards. Foreman was sentenced to life in prison.