 Behind these kinds of attacks is pretty obvious. Rather than a single conventional firm at a time, by going after these third-party IT service firms, they can have vastly broader impact more efficiently. I haven't seen any discussion of how the CDK systems are compromised, but very often in these kinds of cases, there's a breach of a single employee's credentials that is the initial point of entry.