 I haven't seen any discussion of how the CDK systems are compromised, but very often in these kinds of cases, there's a breach of a single employee's credentials that is the initial point of entry. Now, there are issues like how long a firm's services will be down, what it takes to bring them back up. That all depends on their state of preparedness and backups, and there's a wide range of variation in these among different firms.