AutoCanada’s public disclosures describe three separate events—not one continuous attack: a June–July 2024 outage at dealership software provider CDK Global, an AutoCanada internal IT incident disclosed in August 2024, and a separate incident that the company says involved data theft between February 28 and March 8, 2025. AutoCanada’s March 2025 FAQ says some stolen data was later posted on the dark web, but it does not establish that every notified person had every listed type of information exposed.
What happened in the AutoCanada cyber incidents?
The public record contains three distinct events. The CDK Global outage affected a third-party system used by AutoCanada dealerships; the August 2024 disclosure concerned an incident affecting AutoCanada’s internal IT systems; and the company’s March 2025 FAQ describes a later incident involving access to systems and data theft. The available company disclosures do not establish that the August 2024 and February–March 2025 incidents were connected.
| Date | System or provider | What AutoCanada reported | What remained unknown |
|---|---|---|---|
| June 19–July 1, 2024; recovery work continued through July | CDK Global, a third-party provider whose systems supported dealership operations | CDK’s outage disrupted dealer-management functions. AutoCanada said dealerships stayed open using manual and alternative processes. The company later reported lost vehicle sales and associated finance-and-insurance deals, lost service repair orders, and one-time support costs. | On June 24, AutoCanada said it had not identified compromise or unauthorized access to its own systems; the impact and any customer or vendor data held by CDK were still under review. AutoCanada’s June 24 update and Q2 2024 results. |
| Incident identified August 11, disclosed August 13, 2024 | AutoCanada internal IT systems | AutoCanada announced an incident affecting internal IT systems and said its investigation was ongoing. | At the time of the announcement, the company said it did not know the full scope or whether customer, supplier, or employee data had been accessed. The announcement does not establish a connection to the later incident. AutoCanada’s August 13 announcement. |
| February 28–March 8, 2025 | AutoCanada systems, as described in the company’s FAQ | AutoCanada says a cybercriminal accessed some systems and stole data; some of that data was later posted on the dark web. | The company says it cannot reliably determine which exact data elements belonged to each individual. Its FAQ does not confirm misuse or attribute the incident to a named threat actor. AutoCanada’s incident FAQ. |
What information may have been stolen?
In its March 2025 FAQ, AutoCanada says affected data may include personal information and identity documents, financial information, insurance or vehicle-registration records for customers, and employment, payroll, health or benefits documents for employees. These are categories that may be involved, not a list of information confirmed for every person.
AutoCanada says its review used deduplication and similarity-based matching and could not establish with certainty the exact records associated with each individual. The company’s FAQ therefore does not let a reader determine from the public information alone which specific data elements, if any, were exposed for them.
#1 Best Overall
Did the company confirm misuse of the data?
AutoCanada’s FAQ says, “We have no proof that your data has been misused.” That is not confirmation that misuse occurred, nor does it prove that misuse is impossible. The company also recommends vigilance and says it cannot identify each person’s exact exposed information with certainty.
How did the CDK outage affect AutoCanada dealerships?
CDK’s cyber incident began June 19, 2024, and the outage officially ended July 1, according to AutoCanada’s Q2 results. CDK systems supported dealership sales, service, inventory, business development and accounting. AutoCanada said restoration validation and cleanup continued through the end of July.
AutoCanada reported revenue of $1,600.979 million for the three months ended June 30, 2024, down 8.8% year over year. Its release cited the CDK outage alongside weaker performance in several operating areas. Adjusted EBITDA was $26.970 million, down 71.3% year over year; the company attributed the decline primarily to lower gross profit and higher floorplan financing costs, among other factors. These company-reported results describe broader quarterly performance, not a standalone estimate of cyberattack damages.
In its June 24 statement, AutoCanada said: “Our dealerships remain open, and we are continuing to sell and service vehicles, and otherwise serve our customers, through manual and alternative processes.” That statement concerned the CDK outage and should not be read as a description of the separate internal IT or 2025 data-theft incidents.
Recommended Free Tools
What should you do if you received an AutoCanada notice?
- Review the notice and the company’s current incident FAQ for information specific to your situation.
- Check financial accounts and statements for unfamiliar activity, and contact the relevant financial institution promptly if you find anything suspicious.
- Be cautious with emails, texts or calls asking for personal information, login credentials or payment. A notice of possible exposure does not make an unsolicited message legitimate.
AutoCanada’s FAQ offered two years of Equifax Canada identity-theft protection and credit monitoring, with an enrolment deadline of November 30, 2025. That deadline has passed; the historical offer should not be treated as currently available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if you think you may be affected but received no notice?
AutoCanada’s FAQ directs people who believe they may be affected but were not notified to contact the company using the incident contact details on the official page. Check that page for the current phone number and hours before calling, since contact instructions can change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
