It looks like CDK paid a $25 million ransom in crypto to finally end its outage

security
(Image credit: Shutterstock / binarydesign)

CDK Global has apparently paid up in order to end the ransomware attack which recently crippled its operations, and brought a large part of North American car dealership businesses to a screeching halt.

Citing multiple anonymous sources familiar with the matter, CNN claims CDK has paid the attackers $25 million in cryptocurrency to unlock its systems. 

Its report says the company has not confirmed paying the ransomware demand, but multiple anonymous sources, “closely tracking the incident” have said this was the case.

(No) coincidences

Furthermore, two major things happened in the aftermath of the attack which could be tied together.

First, the payment was made in cryptocurrency, and all transactions done over the blockchain (the underlying technology for crypto) can be tracked. Surely enough, they are pseudonymous, but nevertheless, someone sent 387 bitcoin (roughly $25 million) on June 21, to a cryptocurrency account identified to belong to affiliates of BlackSuit, a known ransomware operation.

The address from which the money was sent belongs to a company that helps victims respond to ransomware attacks, the sources further said, without naming the firm. 

Second - CDK Global started bringing its systems back online roughly a week after that payment was made. 

CDK, a company that provides software-as-a-service for car dealerships, suffered a major cyberattack in late June 2024 which forced it to shut down most of its systems.

As a result, companies using CDK’s services were unable to conduct most of their business and were pushed back to pen and paper for whatever little work they could do.

Law enforcement agencies around the world do not encourage victims paying the ransom demand, since there is no guarantee that they will be able to restore their systems and keep their private data - private. Furthermore, there is no guarantee that the same threat actors (or different ones) won’t simply attack the firm again in a month, or two. 

Instead, organizations should work on tightening up their cybersecurity practices and keeping fresh backup copies at hand.

Via CNN

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Less than half of ransomware incidents end in payment - but you should still be on your guard
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Bad news - businesses who pay ransomware attackers aren’t very likely to get their data back
sewage water treatment
Southern Water denies claims it offered $750,000 ransom to ransomware hackers
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
59 organizations reportedly victim to breaches caused by Cleo software bug
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Major ransomware attack sees Tata Technologies hit - 1.4TB dataset with over 730,000 files allegedly stolen
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game