In recent weeks, CDK Global’s customers experienced (and continue to experience) an outage of their dealer management system. This outage has negatively impacted dealerships’ sales, financing, and parts and service revenue streams. In addition, dealers have been forced to spend time and resources dealing with the emergency.
At first, it was widely thought that the outage would be short-lived with minimal impact, but as time passed, the realization that this event could have a meaningful negative impact on the affected dealerships set in. As a result, many of our dealership clients are asking if they can make an insurance claim.
Preparing for an Insurance Claim
We are urging all our dealership clients to take the following steps:
- Reach out to your insurance agent/provider to discuss the type(s) of insurance coverage you have, deductible limits, and other pertinent issues. Ask if you have Dependent Business Interruption Loss coverage. This coverage specifically covers security breaches of entities of third parties with whom you have a written contract. In the event you believe that you might have coverage (even if you think it is remote), submit a notice of claim for business interruption to preserve your rights.
- Do not hesitate to submit a claim notice if you have cyber insurance. Please note that some policies require a formal written notice from the insurance company, so be careful to document the claim adequately. Upon doing so, you will likely be directed to a “breach coach” who will guide you accordingly. The breach coach is essential because they can offer guidance regarding your potential reporting obligations to regulators.
- Contact a cyber specialist to evaluate your computer system. Withum has a cyber security team that can assist you with this.
- There is the possibility that CDK itself may have been negligent for failure to provide adequate precautions or to have mitigated damages once the event occurred. Users may have third-party rights under CDK’s coverage, so reach out to CDK to inquire about this and the services they provide in the wake of the breach.
- Document and keep a record of expenses incurred because of the CDK outage. This will be part of the claim submitted.
- Retain a forensic accountant to assist you in the preparation of your business interruption/cyber insurance claim(s). Withum has the resources to assist you with this, too.
- Work with them to determine whether you have suffered a business interruption loss. The loss, if any, will likely come from one of two sources.
- Loss of income from automobile sales (and leases), parts and service.
- Additional expenses incurred to minimize the loss of revenue, such as;
- Overtime to existing employees or payments to temporary employees because of the attack.
- Payment to attorneys and accountants in relationship to the breach.
- Payments to computer experts/cyber specialists to determine if your system has been breached and/or to help bring CDK back on-line.
- Temporary costs paid to vendors similar to CDK.
- Other costs incurred because of the attack that are above and beyond costs normally incurred.
- Do your best to mitigate any potential damages.
It remains to be seen how long it will take before the situation returns to one of normalcy, and it is expected that there will be bumps along the way as systems are brought back online, making it even more important to keep track of revenue losses and additional costs incurred. As always, Withum is here to help.