CDK is planning to make the payment, a source with knowledge of the situation told Bloomberg. The hacking group behind the attack is believed to be based in eastern Europe, the source said.