CDK Global's dealer management system (DMS) will be fully back online by Thursday after a ransomware attack caused a massive IT outage on June 18th. The company is also working to restore access to other affected applications, including CRM and Service solutions. Over 15,000 car dealerships across North America use CDK's platform for operations such as sales, financing, and service, but had to resort to pen and paper during the outage. CDK also suffered a second cyberattack while attempting to restore service. The ransomware group behind the attack is believed to be BlackSuit, a rebrand of the Royal ransomware operation. CDK is negotiating with the group to prevent leaked data. A joint advisory from the FBI and CISA linked Royal and BlackSuit, detailing similar tactics and coding overlaps in their encryptors.