A shared provider draws its clients into the same disruption

After the cyberattack, who pays? · Part 6/8

An unavailable dealership system pushes payments into the next month; disrupted blood testing puts additional pressure on blood stocks. Disclosures from CDK’s customers and the NHS reveal how a shared dependency changes daily work and distributes the consequences of a cyberattack.

On 7 October 2024, the US Securities and Exchange Commission asked Asbury Automotive Group to clarify the effects of a cyberattack. The automotive retailer had described disrupted sales, additional expenses and delayed payments. The SEC wanted to understand their significance for earnings and cash flows. The affected system belonged to CDK Global, a provider used by other dealership groups too. An interruption at the supplier was appearing in the disclosures of several customers.4

That correspondence opens another way of investigating the cost of cyberattacks. A business can secure its own computers while remaining dependent on the software that runs its sales, a laboratory that processes its tests, or infrastructure used by its subcontractors. When that service becomes unavailable, customers have to adapt at the same time. Each has its own staff and contracts, while part of the recovery timetable is determined elsewhere.

Disclosures from CDK’s customers, followed by NHS documents about the Synnovis attack, trace that dependency to tangible consequences: a debt is paid in a different month, unavailable testing increases demand for a particular blood group, and a replacement software system requires a gradual migration. This investigation follows those documented connections. The public record explains how the disruption travels more precisely than it measures an aggregate loss across all those affected.2108

The fifth instalment on the work of recovery followed the effort required to restore usable services. This instalment examines their reliance on a shared provider.

Shared software becomes part of everyone’s working day

A dealer management system (DMS) connects several everyday operations. Asbury lists sales, service, inventory, customer relationship management and accounting among the functions affected by the CDK incident. AutoNation describes the same set of dependencies. The system connects a vehicle to its sales record and the administrative work surrounding it, so an interruption reaches several teams within a single dealership.23

Asbury’s quarterly filing offers a particularly useful comparison. From 19 June 2024, the outage affected its locations except for the Koons dealerships, which used a different DMS. Within the same group, the boundary of the disruption followed the choice of management system. That observation helps establish the connection to CDK, while leaving the broader security of the different software products untested.2

Recovery had several boundaries too. AutoNation says access to its DMS and core functions was restored on 29 June. Ancillary systems and integrations that automate processes including ordering, scheduling, payment and reporting returned by the end of July. Asbury regained CDK’s functions on 8 July, with other applications coming back online in the following weeks. Those dates describe different customers and different layers of functionality.36

A management system can therefore be back online while a workshop still lacks an automation it normally relies on. AutoNation says its parts and service business continued to experience adverse effects in July. To understand the cost to the customer, a useful milestone is the return of an operation that can actually be performed, with its connections and working capacity restored. A provider’s recovery announcement needs to be read at that level.3

Method and scope

The outage perimeter follows the service in use. Asbury says the interruption beginning on 19 June 2024 affected its locations except Koons, which used another dealer management system, or DMS. AutoNation describes its reliance on the same provider for sales, service, inventory and accounting. The Asbury frame highlights different exposure within a single corporate group. The two lower routes group functions mentioned in the customer disclosures; their sequence and layout are schematic. Connectors represent service dependencies.

Figure fonts and licences

Figure fonts: Inter Variable and JetBrains Mono Variable, under the SIL Open Font License 1.1. Inter · JetBrains Mono.

The documented transmission here is through service unavailability. The cited disclosures establish interruptions to functions dependent on CDK; they do not establish an intrusion into every dealership’s systems. That distinction directs the investigation towards continuity: which tasks can still proceed, through what alternative process, and at what volume?

A deferred payment changes the movement of money

The most visible effect appears in completed sales and services. In its second-quarter 2024 results, Asbury estimated that the incident reduced diluted earnings per share by $0.95 to $1.15, before any potential recoveries. This is a management estimate. It encompasses lost or deferred revenue and expenses associated with the outage, retaining uncertainty in an assessment that depends on judging what normal operations would have produced.1

Cash tells a slightly different story. Asbury’s quarterly filing explains that certain amounts normally paid in June were paid in July because of the CDK outage. At 30 June, accounts payable and vehicle inventory financing balances were consequently higher than expected. That inventory borrowing, known as floor plan financing, funds vehicles before they are sold; its repayment is also a cash outflow.2

The mechanism deserves attention. While a payment awaits execution, the money remains with the debtor and the obligation remains on its balance sheet. Once payment is made, cash leaves and the corresponding liability falls. A reporting date between those two moments captures the waiting period. Deferring an outflow can temporarily cushion the decline in cash even while the business is suffering operationally. It also postpones the creditor’s receipt, although that alone tells us little about the creditor’s financial position.

Method and scope

Asbury links the CDK outage to some payments moving from June into July 2024. The calendar follows disclosed dates; the cash-flow schematic explains the mechanism without assigning an amount. CDK functions returned on 8 July, ahead of other applications.

Asbury does not isolate the amount attributable to this timing effect. The broader change in liabilities discussed near the relevant passage combines several causes and cannot be used to reconstruct a CDK-specific sum. The available disclosure establishes a movement from June into July, with an economic mechanism that is clear and a monetary magnitude that remains unknown.2

This helps explain the SEC’s questions. The regulator compared the estimated earnings impact with reported diluted earnings of $1.39 per share and requested further quantification. Asbury’s release also reported adjusted earnings of $6.40 per share, a company-defined measure that removes items including asset impairments. The choice of earnings denominator substantially changes the impression a percentage creates. The investigation therefore retains the values, their status and the discussion around them.41

Asbury argued for a broader assessment. Its 30 September response said it had considered estimated effects on the quarter, the full year and subsequent periods, using quantitative and qualitative factors. On 17 October, the group proposed adding the estimated earnings range to its next quarterly filing while maintaining its assessment of the incident’s materiality for investor disclosure. It explained the absence of further detail on payables by pointing to their settlement very shortly after the reporting date. The SEC closed its review on 23 October, reminding the company of its responsibility for its disclosures.567

The exchange reveals a limit in public measurement. A single provider can affect several customers, while their earnings and payment effects are reported across different categories and periods. Reconstructing the collective cost would also require tracking transactions with their counterparties, to avoid counting the same transfer more than once or treating a deferral as a permanent loss.

In London, the fallback draws on a shared reserve

On 3 June 2024, a ransomware attack affected pathology provider Synnovis. Several NHS organisations depended on its services, including King’s College Hospital and Guy’s and St Thomas’. The NHS describes both hospital trusts as co-owners of the provider with SYNLAB. Here, the disruption travelled through laboratory work and decisions about care. NHS Blood and Transplant’s 2024/25 annual report describes the impact on systems used to determine patients’ blood groups and check compatibility for transfusions.121013

Difficulties in checking blood compatibility increased reliance on O-negative units. A technology problem at the pathology provider therefore changed the demand placed on a service supplying blood products to hospitals. The adaptation helped care continue, while drawing more heavily on a resource shared with other institutions. Its specialist testing team took on more work and operated longer hours, giving urgent cases priority.10

In its alert of 25 July 2024, the organisation said affected London hospitals had needed 94% more O negative blood since the incident began than in the corresponding period of 2023. The comparison covers those hospitals and that period. It measures neither demand across the whole country nor an annual increase. The alert attributed pressure on stocks to higher demand alongside reduced collections, unfilled donation appointments and the usual difficulties of the summer period.11

Method and scope

Maintaining care draws on another shared resource. Disrupted access to grouping and crossmatching systems increased reliance on O-negative blood. NHSBT describes specialist support and, on 25 July 2024, reported a 94% rise in requirements at the affected London hospitals since the incident began, compared with the same period in 2023. The indices of 100 and 194 are calculated from that percentage. Reduced collections also put pressure on national stocks; qualitative relationships carry no causal weights. The source does not provide absolute volumes or the exact statistical window. Calculation: an index of 100 for the comparable period in 2023 becomes 100 × (1 + 94 ÷ 100) = 194 in 2024. This index concerns requirements at affected London hospitals only, without absolute volumes or causal weights for national stock pressure.

The reserve becomes the meeting point of several constraints. The cyberattack contributes to increased demand for one type of product, while collections determine the ability to replenish stocks. The documents do not allocate national stock pressure quantitatively between those causes. They do, however, establish a full mechanism from interrupted laboratory services to the blood supply service brought in to support them.

Postponed care provides another measure of disruption. NHS England’s update published on 26 September reported a cumulative 10,152 acute outpatient appointments and 1,710 elective procedures postponed at the two most affected trusts, through 22 September. These are provisional, unvalidated management figures. They count postponements and may include the same person more than once. Adding the sixteen rows in the separately published weekly table gives 10,257 appointments and 1,857 procedures, exceeding the announced cumulative figures by 105 and 147. No explanation for that difference has been established. The figures quoted here remain those of the dated announcement, with their provisional status; source note 12 explains the comparison.12

By 26 September, NHS England said GPs in south-east London again had access to the full range of pathology tests, while blood transfusion systems were still being restored. The NHS update dated 10 November 2025 says Synnovis services had been fully restored by December 2024. As with the dealerships, recovery has to be followed function by function. In hospitals, it also involves backlogs and mutual aid that a simple measure of IT availability captures only partially.1213

The difficulty of switching is part of the dependency

The Koons exception raises a reasonable question: why remain with a shared service when another product exists? Asbury’s later filings provide a practical answer. Its 2025 annual report, filed in February 2026, says 38 stores had moved from CDK to Tekion by 31 December. It describes potential expenses from running both systems, the work involved in the transition and temporary productivity losses as staff learn the new software.8

The project continued in 2026. The second-quarter filing records 25 store conversions during that quarter and, in its analysis of the first half, discusses implementation and duplicate system costs. Those observations document a migration proceeding over time. The filings also describe expected efficiency gains and technological improvements; they do not support attributing the entire project or its budget to the 2024 cyberattack.98

In banking, European supervisors have an indicator of this difficulty. An ECB analysis published on 19 February 2025 uses significant institutions’ outsourcing registers as at the end of 2023. Among contracts that were both critical and external, 73.7% of the budget concerned providers whose replacement was assessed as difficult, and 8.6% providers whose replacement was assessed as impossible. Together, those categories accounted for 82.3% of the relevant budget. These are reported assessments weighted by budget, rather than a share of banks or the results of completed migration tests.15

Another difficulty can sit behind the apparent diversity of contracts. In its December 2023 toolkit, the Financial Stability Board describes an institution using the same provider directly and through other suppliers’ subcontracting arrangements. Several commercial relationships can therefore converge on a shared technical dependency. The UK National Cyber Security Centre recommends mapping suppliers, their services and subcontractors, with the depth of investigation guided by their importance to the business.1419

Method and scope

Separate contracts can share one dependency. The upper network illustrates a mechanism described by the FSB: shared infrastructure may transmit an interruption to several services. It is independent of the banking measure below. The bar reproduces the values in the ECB chart published on 19 February 2025, based on year-end 2023 outsourcing registers. These are shares of the total critical and external outsourcing budget of reporting significant institutions. Categories marked difficult and impossible account for 82.3% of that budget, reflecting the assessments entered in the registers. Calculation: 73.7 + 8.6 = 82.3%. The remaining share is 17.7%. Shares concern the budget of critical external contracts, using substitutability assessments reported for year-end 2023, rather than a count of banks.

Concentration also brings benefits that the analysis needs to retain. The FSB explains that, in some circumstances, relying on a market-leading provider can pose less risk than an in-house solution or several suppliers. Size or market share therefore describes only part of the risk. The importance of the service and the practical ability to replace it help determine how severe an interruption could become.14

Preparing an exit means making migration workable: moving data and applications, identifying an alternative provider or an in-house solution, and checking the skills available. Published on 16 July 2025, the ECB’s cloud outsourcing guide recommends preparing those resources and reviewing exit plans, with proportionate testing of critical migration steps. An exit clause becomes useful when the necessary resources are actually available.16

Organising recovery across the customer network

A supplier relationship allows each business to negotiate its own continuity arrangements. Shared dependencies introduce a collective constraint: several customers may need assistance, alternative capacity and restoration at the same time. A contingency plan therefore benefits from examining whether those resources will be available when the rest of the network needs them too. This is an analytical implication of the common dependencies described by the FSB, which distinguishes an individual firm’s resilience from that of the system in which it operates.14

In the United Kingdom, financial oversight has begun to reach certain critical providers directly. An announcement on 10 July 2026 set out the first designations, effective on 13 July, covering AWS EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK. UK authorities connect this oversight to services whose disruption could threaten financial stability. It applies to the providers and services within that regime; it is not a general certification of their products.17

On 8 October 2026, SIMEX26 brought together 38 major banks and market infrastructure operators to rehearse a global cloud services disruption. The statement published the following day says the scenario was developed for the exercise and was not informed by intelligence about a specific threat. Participants worked with the authorities on a coordinated response. The announcement does not provide detailed results, but the exercise’s scope shows the level at which preparations are now being discussed.18

The CDK record brings dealership operations and payment dates into that discussion; Synnovis adds laboratory capacity and the reserves needed to sustain care. In both cases, the purchased service becomes part of work extending beyond the supplier. A precise question follows for the period before a crisis: which activities could continue, using which resources, when other customers are seeking those resources at the same time? Answering it involves the contract, the organisation of work and the collective capacity available to absorb the interruption.

Further reading

The fifth instalment on recovery follows the work and contracts involved in rebuilding. The cyber insurance investigation examines cover for interruption at a third party. The glossary explains shared dependencies, reversibility and service availability.

Sources and method

This documentary investigation is current to 19 October 2026. It draws on nineteen primary references: regulatory filings, public correspondence, institutional reports and supervisory publications. The source notes distinguish incident dates, observation periods and the dates written on letters; the SEC correspondence’s first public release dates remain unestablished. Company figures are attributed to their authors, and the illustrations’ calculations can be reproduced with their scope made explicit.

The selected public record does not include CDK’s contracts with the customers studied, detailed invoices or a separately quantified amount for the deferred payments. Hospital outcomes retain the status assigned to them by the NHS. This investigation uses public documents, without interviews or external requests. Calculations and denominators appear beneath the charts. Customer contracts and execution records would be needed to take the investigation further.

Numbered references link to the documents below. Accessed: 19 October 2026.

1. [1] Asbury Automotive Group · Asbury Automotive Group Reports Second Quarter Results · 2024-08-02. Pages 1–2: GAAP and adjusted EPS, estimated CDK impact; p.13: reconciliation; p.5: calculations use unrounded amounts. The release estimates the Q2 earnings effect and permits comparison with the two reported EPS measures for the same period. Management range including lost or deferred income and one-time costs, before recoveries. Adjusted figures are non-GAAP; displayed reconciliation items are rounded.
2. [2] Asbury Automotive Group · Asbury Automotive Group Q2 2024 Form 10-Q · 2024-08-09. Page 28: CDK-dependent services, Koons exception and restoration sequence; p.49: payments normally due in June made in July. Asbury describes the operational perimeter of the outage and its effect on the timing of certain payments. The amount of payments deferred because of CDK is not isolated. Nearby aggregate cash-flow or liability changes do not measure that effect.
3. [3] AutoNation · AutoNation Q2 2024 Form 10-Q · 2024-08-01. Page 27: DMS/core access restored on 29 June, integrations by end-July, earnings effect; pp.36–40: inventory, service and F&I; p.46: continuity compensation. A second customer of the same provider confirms dependency across business functions and the gap between restoring core access and restoring automation. AutoNation’s reported timeline. Lost-income assessments are internal estimates, not itemised invoices or evidence of infection of customer systems.
4. [4] SEC Division of Corporation Finance · SEC letter to Asbury dated 7 October 2024 · 2024-10-07. Pages 1–2, comment 1: comparison with 68–83% of reported EPS and request to quantify effects cited on results and operating cash flow. SEC staff seek quantitative information to assess the incident’s significance in Asbury’s disclosures. Financial disclosure review; the letter establishes neither a final loss amount nor a sanction. Letter dated 7 October 2024; first public release date unconfirmed.
5. [5] Asbury Automotive Group · Asbury response to SEC dated 30 September 2024 · 2024-09-30. Response to comment 1, indexed primary passage covering the assessment of quarterly, full-year and subsequent-period effects using quantitative and qualitative factors. This is the company’s position. The complete original could not be reread during verification; only that scope of the indexed passage is used here. Letter dated 30 September 2024; first public release date unestablished. Official issuer copy, indexed passage.
6. [6] Asbury Automotive Group · Asbury response to SEC dated 17 October 2024 · 2024-10-17. Page 2: planned insertion of the estimate into the next report, retained materiality judgement, payments made shortly after period-end. The response links a proposed disclosure change with the temporary nature of some outstanding liability balances after the outage. The specific amount of deferred payments remains unknown. The company retains its non-materiality judgement; this is not a regulator’s finding. Initial public release date unconfirmed.
7. [7] SEC Division of Corporation Finance · SEC completion letter to Asbury dated 23 October 2024 · 2024-10-23. Page 1: notice of completed review and reminder of the company’s and management’s responsibility for disclosures. The final letter establishes the conclusion of this 2024 comment exchange. Completion of this document review, not a general approval of disclosure accuracy or cybersecurity. Initial public release date unconfirmed.
8. [8] Asbury Automotive Group · Asbury Automotive Group 2025 Form 10-K · 2026-02-20. Page 29: 38 stores moved from CDK to Tekion by 31 December 2025; overlapping systems costs, migration difficulty and learning effects. The report describes the commitments and practical difficulties involved in replacing the DMS. Expected Tekion benefits remain attributed to Asbury. This document does not establish that the cyberattack caused the project; migration and incident damage have different perimeters.
9. [9] Asbury Automotive Group · Asbury Automotive Group Q2 2026 Form 10-Q · 2026-07-31. Page 56, changes in internal controls: 25 stores converted from CDK to Tekion during Q2 2026, with procedures adapted. The latest follow-up document examined confirms a staged migration continuing during 2026. The 25 stores are a quarterly flow, not a cumulative total. They cannot simply be added to the 38 at end-2025 without reconstructing Q1 and perimeter changes.
10. [10] NHS Blood and Transplant · NHS Blood and Transplant annual report and accounts 2024–25 · 2025-07-17. Printed/PDF p.22: blood grouping, antibody-screening and crossmatching systems, specialist support and greater reliance on O-negative units; repeated on p.97. NHSBT explains how a pathology-provider outage affected blood requirements and the capacity of supporting teams. Management narrative from an organisation involved in the response. Higher requirements contributed to stock pressure; no quantified share of the national shortage is given. The narrative paragraph is not an independent incident audit.
11. [11] NHS Blood and Transplant · NHS calls national blood shortage amber alert · 2024-07-25. Opening paragraphs; “Why is there a shortage?” section. Date visible in original HTML: 25 July 2024. O-negative demand at the affected London hospitals was 94% higher since the incident began, compared with the same period in 2023. The statement also describes reduced collections and summer donation constraints. Percentage attributed to NHSBT: absolute volumes, exact statistical window and extraction time are not published. The 2023=100 / 2024=194 index is calculated from this percentage. Additional hospital demand is not the whole national demand. The 170 donations per week are another expression of the same increase.
12. [12] NHS England · Update on cyber incident: Clinical impact in south east London : Thursday 26 September 2024 · 2024-09-26. Announcement of 26 September 2024, covering the period through 22 September: 10,152 hospital outpatient appointments and 1,710 elective procedures postponed at the two most affected trusts. Provisional, unvalidated management information; postponements may include the same person more than once. Transfusion systems remained under restoration after GPs regained access to pathology tests. The primary content was read through its indexed copy because direct HTML access was unavailable during verification.
    Comparing cumulative totals and weekly rows

    The official weekly table, also consulted through its indexed primary content, covers sixteen weeks from 3 June to 22 September 2024. We sum hospital appointments and elective procedures only, excluding community appointments. The 5–11 and 12–18 August rows are cross-checked against the 22 August announcement. Appointments: 900 + 1,301 + 1,300 + 1,517 + 1,286 + 1,028 + 1,122 + 1,074 + 578 + 53 + 29 + 21 + 25 + 11 + 6 + 6 = 10,257; 10,257 − 10,152 = 105. Procedures: 814 + 383 + 205 + 136 + 100 + 71 + 46 + 52 + 20 + 13 + 3 + 4 + 2 + 2 + 1 + 5 = 1,857; 1,857 − 1,710 = 147. The documents read do not explain the difference. We retain the announced cumulative figures and publish this comparison separately, without an assumed reconciliation.

13. [13] NHS England · Synnovis cyber incident : update of 10 November 2025 · Date unestablished. Update dated 10 November 2025, first three paragraphs. NHS England describes Synnovis ownership, the 3 June 2024 attack, its effect on testing and full service restoration by December 2024. 10 November 2025 is the displayed update date; the original publication date is not established. Provider service restoration does not date the completion of every deferred appointment or resolution of every consequence. The page’s primary content was consulted through its indexed copy because direct HTML access was unavailable during verification.
14. [14] Financial Stability Board · Enhancing Third-Party Risk Management and Oversight: A toolkit for financial institutions and financial authorities · 2023-12-04. Section 3.5.4, printed p. 25 / PDF p. 29: overlapping direct and indirect dependencies; sections 3.8 and 4.3.2, printed pp. 28–30 and 35–37: potential benefits of concentration and criteria for systemic risk. The FSB explains indirect dependencies and the conditions under which a common provider can transmit a disruption to several institutions. Non-binding analytical framework. The l0g network is an explanatory diagram; no probability, quantified loss or named company architecture is inferred.
15. [15] ECB Banking Supervision · Outsourcing trends in the banking sector · 2025-02-19. Introduction: 2024 analysis based on year-end 2023 registers. Chart “Substitutability of providers per contract”: share of the total critical and external budget. “Sub-outsourcing” section. The chart distinguishes easy, difficult and impossible substitution within reporting significant institutions’ budgets for critical external outsourcing contracts. Budget shares, not bank counts or a cloud-only measure. Historical year-end 2023 data and reported categories; 82.3% is the calculation 73.7 + 8.6, rounded to 82% in the ECB prose.
16. [16] ECB Banking Supervision · ECB Guide on outsourcing cloud services to cloud service providers · 2025-07-16. Guide, pp. 6–9: concentration, shared dependencies and continuity; pp. 13–15: exits, transition, costs, skills and testing. Release of 16 July 2025: the Guide’s legal nature. The final Guide links continuity and exit arrangements to the applications, data, timing and people required. Supervisory expectations and good practices must be distinguished from underlying DORA obligations. The Guide creates no new binding rules and gives no universal switching time. Guide publication announcement.
17. [17] Bank of England, PRA and FCA · UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury · 2026-07-10. Release, opening paragraphs and Notes to editors: first four designations effective 13 July 2026, rules effective 1 January 2025. SI 2026/777, regulations 1(2) and 2; current FCA list. UK regulators start oversight of the systemic services of four cloud entities designated by the Treasury. Oversight concerns services to the UK financial sector; designation is not general authorisation. Banks retain their own third-party risk responsibilities.
18. [18] Bank of England · CMORG holds sector-wide cloud outage simulation exercise · 2026-10-09. Opening three paragraphs: exercise held on 8 October 2026, 38 banks and market infrastructure operators, global cloud disruption scenario. Note to editors 4: no specific threat information. SIMEX26 brings banks, infrastructures and authorities together to rehearse a collective response to unavailable cloud services. A simulation, distinct from an actual attack or outage. The release publishes no loss estimates, individual recovery results or success rates.
19. [19] National Cyber Security Centre · Mapping your supply chain · 2023-02-16. Sections What information should SCM contain? and Subcontractors in the supply chain. Page published on 16 February 2023 and reviewed on 12 October 2023. NCSC connects supplier and subcontractor mapping with an understanding of critical services and shared dependencies. Guidance, with no loss estimate or company-specific architecture. Useful mapping depth depends on criticality and collection costs.

Original text and illustrations: l0g · CC BY 4.0. Cited documents retain their publishers’ rights.