Systems that support sales, service, and inventory for more than 15,000 dealerships have been shut off since June 19th in the wake of two separate cyberattacks.

After some dealers resorted to pen and paper to keep going amid reported negotiations between CDK and the BlackSuit ransomware group, Reuters reports restoration work has begun but that it may take “several days.”