#332 - Cyber Shutdown

This is the Independent Dealer Podcast, Education by Dealers for Dealers. Now, here are your hosts, Luke Godwin and Jeff Watson.

Hello and welcome to the Independent Dealer Podcast, brought to you by Buckeye Dealership Consulting. Luke, before we get into our topic today, I want to make sure everyone knows about the rebooted newsletter that we got going on.

Yeah, it's great, Jeff, you're doing, you've done a wonderful job.

Well, we both put together a lot of stuff, and what we've done is we've, we've formalized it into what we call the 52 week guide to a Better Dealership. So it's called the Owner's Manual, which is basically for dealership owners. And what we've done is broken it down into 52 different areas that you can focus on in your dealership. So over the course of the next year, we're going to guide you through, you know, topics that range from, you know, setting up your LLC and starting your business, your, your business plan, your, you know, mission statement, all the way down to, you know, secession plan and how you plan on exiting the business. So we really cover the whole360 of your dealership and we give you a topic to think about, we give you homework. You know, that's a great word. Everyone loves that. Something to do in your dealership, you know, an action plan. And we also give you the weekly meeting agenda, which has been really cool for me because I use it, you know, I say, hey, you know, this week we're talking about inventory buying, right? Let's all talk about the best cars for us to buy, what we don't buy, let's revisit that. And, and then we have a quote of the day that we share with our team. So it's really, really helped me with my weekly meetings, but it gives me, it gives me that, that forced to really focus in on these specific areas.

Yeah, that's, that's a hard thing for owners to do. You know, you're supposed to be doing something all the time, right? But sometimes you don't know what, what you need to be doing, right? And so I think it's very important to follow a guideline, and this is a good guideline that we put together for y' all to look at. And then why you look at that? Go to our YouTube page, to the Independent Dealer Podcast YouTube page. And, and I think you can search on there this topic and I'd be willing to bet you there's a video on there or something along this topic that you can watch in other Podcasts of ours that are short of ours that will help you kind of dig a little deeper in. Into what we're talking about.

Absolutely. Yeah. That's a great resource. Go into the YouTube channel to get some more education to do a little bit of a deeper dive. Because, of course, the newsletter, we try to keep it light. We try to keep it easy to get through. So go over to the independentdealer.com scroll down a little bit. You'll see the newsletter link. Go ahead, put. Drop your email in there. Subscribe so you can get this every single week. It does make me think we need to change one of the topics, though, Luke, and maybe have more of a depth on cyber security.

Man, I tell you, big, big deal right now. And for folks out there that don't know what's going on, cdk, who is, I would think probably the largest DMS provider for franchise stores in the world, is being held hostage by, I love how they say Eastern European faction.

Yeah, yeah.

Which means Russians. Russians have. Have taken over CDK and at first glance, go, oh, well, who cares? You car. New car store, and they can't do deals. It goes a lot deeper than that, Jeff. You know, you talk about wanting one program that does everything. Well, guess what? Cdk. CDK is one program that does everything. And it. It's their DMS, it's their integration. CRM is their integration with Route 1 and with all the other captive finance companies. It's their RO Rider.

Yes. So the shop.

The shop is their labor producer.

And the parts ordering.

And their parts ordered.

And. And from the oem.

From the OEM and their OEM website. Integration. And the last, most important thing, Jeff, that we've talked a lot about. Well, people at NIADA talked a lot about last week. It's how they pay their employees, their payroll taxes and all.

So next to ADP, or integration.

And right now, they can't even pay their employees, Jeff, properly. And they can't sell cars without handwriting things. They. You try to order a part from a new car store that's on CDK right now, it is a freaking nightmare. We are actually. This is no lie, Jeff. We are having to go to their. Their parts counter.

Oh, wow.

Write a check. They are handwriting us a receipt. Wow.

Own.

Own one of their, you know.

Yeah.

Invoices. They're handwriting us receipt, and then we can take the part. They cannot deliver you parts right now. They can't necessarily tell you they have a part in stock. Somehow they're looking up the. The parts and they're walking back to the shelf and picking it up. So this is a nightmare. What would happen if it happened, if this happened in your dealership? That's idms what got held hostage.

And I think we should get into some of the lessons learned from this and not, you know, obviously the situation is, is not good. And you know, supposedly the reports are this group wants $50 million, un. Unscramble the data and no, no telling if any of that data has actually left CDK servers, you know, so that's scary. That's got customer data, names, info, Social.

Security, Social Security numbers.

Right. Think of everything you've given that you put in your DMS. That's all gone. So they want 50 million, unscramble it and they say it's going up 10 million a day, which is wild. Right. And who knows if it comes out accurate, who, you know, if you're going to get it back, if they, they say it's going to definitely push through the end of the month before they even think of getting people back online.

And that's.

Ports are. They're going to pay the ransom, Right?

You can pay the ransom, but like you said, who's a guarantee your data is going to come back properly and back to the right store? Right. A good friend of mine. A good friend of mine who we bought our dealership property from and been a friend of the family forever. They own about 12 to 17 stores. I text him yesterday, I said, you messed up in this. And his response essentially was. It was, it was just one word. Yes. I was like, oh man, I'm so sorry. And I mean they, you know, they're a big company and they sell probably, you know, a couple thousand cars a month. Yeah, they are just.

I just, they're crippled. Right. So I want to talk about that. But, but I also want to talk about, what's interesting is it's, you know, you talk about 15, 000 dealerships in the US that are at a halt right now, right?

Yeah.

And they're all scrambling different ways to try to pick up the pieces and keep things going. You know, like, they talk about paper. What it's also doing is, you know, everyone says CDK was pretty antiquated. It was like, you know, they didn't really, I think maybe they had two factor authentication or. But they didn't have like required password changes every 30 days. And, and obviously a hack of this size, the first hack went through which shut them down. It obviously it had to have been on some sort of a programmer or someone who has like core, you know, access y to the, to the database. And then they tried to restore it from a, from a backup or from a second and, and they got hit again the second time and that's what really took them down. And I think someone tried to hack in through adp. And so you've got all these kind of like piggybackers that are posing a CDK trying to get into these other systems. But what it does unfortunately is now you look at some of these guys and they're all jumping ship and switching over to other GMS and CRMs. Guess who owns the other DMS and CRMs? Cox Automotive. So now everyone's jumping over to binge solutions. And so it's almost like the monopoly that Cox Automotive has on that industry is just growing through something like this.

Unless, you know, you think about it, how many actual dmss are out there? Let's talk about new car stores. You know, you have three rentals and rentals CDK VIN solution. I think you know, some of the smaller dealers I was told, I asked a couple other people I know pretty well and what they're using. Auto solved. There's five max. And if you're a big time dealership, it's cdk our rentals and rentals.

Right.

And think about that from an independent perspective. There's three or four. Right. If you're, and if you're lease here, pay here. Oh my gosh, there's one. This is, I don't, I don't know, I don't know where this leads to from, from security side. But every time something like this happens, it gets harder to log into your dms. It gets harder, it gets harder for, so for, for you to get a vendor that needs to get the API in. It gets even harder for that to haven't cost more money. Just think about, I mean, every time you need a new API, it's another 100, 150amonth, right, Jeff?

Yeah, yeah, definitely. What it makes me think is, is obviously the first thing guys and the lessons learned from this is going to be to vet the vendors that you do deal with, right? Are these vendors that are, you know, are they so new to the space that they're kind of just like flying by night? Is it just some guy that built it in his backyard and hasn't even thought about any kind of security or data breach? You know, about five years ago we had a, a local server here inside my office and I used it to share, you know, documents and photographs and videos amongst the networked computers and we got, you know, ransomwared and everything got locked down. And there was this little file that said, do this, this, this, this and this. And I was like, yeah, screw you guys, I'm not doing any of that. Like, I don't care. Take my, take my word documents. Yeah, we just, but, but you got to look at that and say, okay, are these vendors that I'm dealing with reputable? Do they take security serious? And you should ask them all those questions. So yes, when it gets inconvenient to do two factor authentication or when they make you change your password every 30 days, I get it. But those are the steps that you have to take to make sure that you don't become a victim, you know, yourself. And of course you hope that they're taking that internally. Now I don't think someone can hack my, you know, log into my DMS and have access to the entire back end of the dms. No, they're not going to get it through my password. Right. They're going to get it through one of their employees or their high programmer who actually has access to that.

And what's funny about that is, Jeff, and you and I both know people that have worked for certain DMS companies that six months after they no longer work there, maybe up to a year still had high level access. That makes you feel a little squeamish, right?

It does, it does. And then you say, okay, am I at a DMS where maybe they're an afterthought and the parent company might not care so much about them anymore? Are they, you know, going to be a little lackadaisical when it comes to, you know, data security, things like that.

Yeah, that's, that's really scary. And that, you know, you talk about and I think, you know, we've had Steve Levine on a couple times and actually talked about some of this cyber hacking type situation. And I think he was, he had a good point of, of how to vet your, your vendors properly. But you also need to make sure that your employees know what to click on and what not to click on and what websites they can visit and what websites they can't visit. And so it, it starts to get your brain turning. Like, man, what websites do I need to make sure a lockdown and they can't go to, which I don't know how to do. I'm sure it can be done out there, but, and how to teach them. These are the only, you know, only things you can click on. I've shared this with the, with the community out there before and talk about how we. During COVID because everybody was home, somebody cloned one of our emails, sent it to the comptroller, and got the comptroller to change the bank information for an employee. And oh my gosh. And two paychecks were gone. So these things happen to everybody.

Yeah, they talk about that, you know, the phishing scams and the, you know, saying, hey, hey, you know, I need you to wire this money to this account, you know, and it's like, okay, stop. Think about it. Yeah. You know, double check. Don't click on links. Don't. Don't go through hyperlinks that people send you. Oh, man. Educating your employees.

I don't know if you saw this, but Nia Ada had somebody hack into their website or their email the other day, and I've got two separate emails asking me to. To click on this to do a bid proposal. And then after that, it wanted you to log into your Microsoft 360. So right then, you know, oh, this is weird. You know, Anyway, just make sure that you're clicking on the right things. But Jeff, what if this did happen to our dms?

Yeah.

What are we supposed to do?

So this is the second lesson I learned. You know, on top of vetting them, I would say making sure you have redundant systems. Right. And like Luke said in the beginning, I've argued for so many years that, like, man, I wish I just had one solution that did everything. I wanted to do this and this.

And this and this.

And I want it to be one price and all talk to each other. This makes me completely rethink that. Right?

Yeah, I think so.

If you have a 1:1 system that handles everything like these guys have with CDK. Right. And granted, this is maybe a once in a lifetime situation and they might be down for two weeks and they'll recover and we won't ever talk about it again. But do you have redundant systems? If you went over and unplugged your Internet right now, would your dealership still be able to function? Right.

Yeah. And that's so everybody. Everybody needs to know how to handwrite a deal. I know. That's insane.

You have those contracts.

So interesting you ask two Fridays ago, and I don't know if it happened to you, but IDMS printing went down all day. Did you have that problem?

I wasn't in the office, but I heard.

So guess who didn't deliver any cars two Fridays ago when we had like three or four cars ready to deliver? This guy.

Yeah.

So did we get them back in on Monday. I think three of the four. But think about that. We lost a deal.

Yeah.

Because of this exact situation. So what do we do moving forward? I was Talking to another 20 group member and he's like, you know what? I think we need to make sure we build a spreadsheet and get it vetted to be able to calculate payments manually and have it to go in to fill out the contract. So if we need to. To handwrite a contract to get a car delivered, we could do it, because I think that's super important. So we can handwrite everything else, but the contract is the only one that. That gets you a little scared, right?

Yeah. And. And there's some solutions. But what about. Do you. I was like, I don't even own an impact printer. I don't know what I would print on. But to have the paper forms just sitting in a closet somewhere for the one day I might need them. What I need a couple of retail installment contracts, some bill of sales, some odometer disclosures, like, so real quick, everybody.

Stop what you're doing. Don't stop listening to the podcast. You might pause it for a second. But what I want you to do is go and save a PDF of every single document you have. Just save it and put it on your desktop as emergency forms. Okay. That way you can print those PDFs and you can handwrite because the poop hits the fan. We got to have a way get cars delivered. We did not. It cost us a deal. So, you know, be prepared for the worst. Jeff, back up to what happens if your Internet goes down. I've been there.

Yeah.

You know what? That's the reason we have cell phones. We can. We can flip on a hotspot and we flip on hotspots. All our computers can hook to it wireless and we can keep going our phones. We have a problem there, but, you know. Oh, well.

But you could go back to doing it by paper. Right. So either you have a PDF that you can edit and then print it out, or you print it out, handwrite it.

That's right.

The other thing that some of us don't know is that some of our software providers actually have modules that run things that our other software providers don't have. Right. So if my DMS went down, I actually have access to Dealer center through my auto check. I could go into Dealer center and start printing out forms and contracts and desking deals if I have access to it. Or if I need to make a couple of phone calls and have them Flip it on for me. Those are some options as well, right? Some of these guys have. If my. If my shop software got hacked, right, And I couldn't access my shop, my parts ordering, you know, what's my backup for that? Do I have a. Do I have a direct parts ordering with. With, you know, autozone and Napa, you know, can I. Can I go through them directly? And instead of through the software that I'm using now, if my software underwriting, you know, my CRM got shut down, do I have the ability to go in and see where my leads are coming from? Right? So they're coming through my website or they're coming through Facebook. Guess what? Both those platforms keep a copy of that information before they send it on to my CRM. So, yeah, I can log into my website, I can still see people who are filling out applications, and then I can reroute them if. If it's my CRM that went down. So having those redundant systems and actually knowing what they are, I think is. Is a really, really good thing to have either written down or just try it sometime, right? See if you can access them.

That's it. You know, I like the idea of writing this down, Jeff, and having, you know, and it's probably 10 bullet points, right? If the Internet fails, what do we do? Right? If the power goes out, what do we do? If the DMS goes down, how do we take payments? And, you know, we go back, we have. We have extra receipts, receipt books. We. If. If we can't take payments, we walk into the back and we look in their file and we see what their payment's supposed to be and we take payment. You know, there's all kind of ways to get around when your software goes down. Because, Jeff, I'm a little older than you in this business, but.

But that's.

I remember taking payments that way. I remember filling out finance contracts with a little flip book. It would tell you, okay, this is interest rate. You charge, and you flip through it and you came up with the payment and you fill out the finance contract. So I remember doing all these things. The people work for. You don't remember doing all these things unless you have some real old guys there.

Do you have a. Do you have a separate credit card processor? If one of your credit card processors got shut down, do you have any credit cards?

I don't. I would call my folks at blitzpay and be like, y' all gotta do something, please.

Yeah, that's actually a good. A good point to mention. The guys at Blitzpay Obviously, it's who we use for our credit card processing. Great, great men and women over there that I do know take serious. Very security. Very serious, right? Yeah, they take serious security over there. So they're great guys to reach out to for your credit card processing. I still have a physical terminal at my dealership that I use through a different processor, right? So my finance company that takes my payments through Blitzpay, and then I have a terminal for my dealership as far as down payments and shop repairs. So because I have two checking accounts, I have two credit card processors, right? And so whether that's a square or, you know, just a. A terminal that you get from your bank, it doesn't really hurt to have those. You could use them especially have two accounts. You should have two. But that gives you that redundant backup.

We have our service department. We've had to do it before. Now that you think about it, I forgot all about that. But if. If. If everything goes down, we take the payments on the service clover deal, and off we go. Yeah, you got to have it. You don't even think about those. You don't even think about the things you have until you're put in a position. You got to use it, and you're.

Looking around like, wait a minute.

Oh, my gosh. Yeah. Yeah.

Don't ask me how to run a credit card on that machine. I have no idea, but I know we have it. And, Luke, when was the last time you backed up? When was the last time you took a hard backup of your data? Never have I ever. No. No, I haven't. Now, that also leads to the question of, do I have access to my data? So, say, inside my DMS or my CRM, I have thousands of people's name, information, phone number. Right? Yeah, both deals I'm working and deals I would like to work. And I've spent a lot of money to build up that database. Right? Tons of right. And. And I should be working that database better than I am. I'm not. But if that just wiped away one day, got hacked, frozen, and I never saw it again, I mean, I'm in big trouble. Not to mention my buy here, pay here customers, like, do I know what they owe me today? Do I knew what they owe me on Friday? Could I rebuild that database if it got wiped out or frozen? No. Did I back anything up on Friday? Did I. Did I even save a hard copy of, like, maybe my AR balance that I printed?

I wouldn't even. I wouldn't even know how to do that. Like, I mean, let's be real, right? Isn't this something that our, our providers should have? Like, shouldn't. I mean, shouldn't it be required that IDMS, every 20 seconds makes a hard copy of everybody and pulls it off the Internet and pulls it off of their server, their AWS servers, or sticks it in another AWS server. Well, where there's a firewall that nobody can get through.

I don't know. I bet they don't. They probably have some version of a backup. Like, I think CDK had a, some sort of a cold or hard backup, whatever they call it. But for me, would it be that hard, Luke, to say once a month or once a week, I'm going to run a report of my total AR name, cyber. I can do that very easily. I can export it into Excel and I can put it on my computer. I can put it on a jump drive. I can take that jump drive and stick it in my safe, Right? And if I do that once a week, once a month, once a quarter, I would have a backup of both my current portfolio and customers. And I could also do that probably for my DMS or CRM if I really wanted to save everyone's information in some sort of a hard storage that's offline. Now we can go down the road of what kind of liability does that give me if I'm pulling people's data off, putting it on my hard drive and storing it in my shoebox? You know, that, that, that, that is not an answer for me to, you know, have, because I'm not so good at that. But it does beg the question, whose data is it? Is it my data? Can I get access to it when I want to, and am I responsible to keep it safe?

It's. These are, these are interesting questions. And, you know, the latest thing out is that CDK said they're not going to be able to get everybody up and running by the 30th, which. Which is going to create massive problems for paying managers, salespeople.

Yeah.

There'S gonna, there's gonna, you know, anybody on the edge of working at a franchise store is going to be jumping off that edge on July 3rd.

Yeah. And that's to wrap this up and put a pin in it, Luke. That really is one of the saddest things about this is a. The fallout, right? Not only from the lawsuits that are going to happen between dealerships and CDK and providers and maybe even consumers that feel like their data was breached, but.

Definitely some of that.

Yeah. The dealerships that may have been hanging by a thread because they're getting pounded by floor plans, interest rates. They're getting pounded by know not have an inventory or slow sales or whatever it is. Some of the big, obviously these big, big groups, sure, they can float their employees. Maybe they're going to be generous and pay them regardless and then just reconcile later. But man, this, this can really take a hit. You got a bunch of mechanics stand sitting around that aren't doing anything and then all of a sudden, in a week or two, you're going to have them working twice as hard, making double overtime, right? And you're going to have salesmen that are like, dude, I'm this isn't worth it anymore. I have this flat paycheck. I got to get out of here. Wow, what a mess.

It's gonna be a mess. And protect your data is. Is what we're preaching here and have redundancy and how you do your business. Some of, some of y' all listening may not even have a DMS or you know, a very rudimentary dms. Just be aware, one bad email could come in and just screw you up.

So yeah, yeah, I would definitely say if you don't have one, go get one. No matter your size, there are solutions. All budgets, all size of dealerships. If you think you can keep track of this stuff on an Excel spreadsheet that you save to your own laptop, that's very dangerous. Don't do that. Yeah, go with, go with at least the quote unquote professionals. This is kind of proven or not so professional. Be interesting if the FBI gets involved with this and they get to the bottom of how this actually happened now.

You know, you just wonder, things like this have to happen in Russia, right? Because if it happened anywhere else, we'd probably be over there figuring out who did it.

Yeah, crazy stuff. Okay, guys, remember, thanks for listening. Subscribe to the Newsletter get our 52 week guide to a better dealership and reach out to us. Let us know what you think if you want any more information. But we will talk to you next week.

Thank you for listening. Please leave us a review. We'll catch you in the next episode.