Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 70

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 70
---
 and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, malware, lost or misplaced data, programming errors, scams, ransomware, burglary, human errors, acts of vandalism, misdirected wire transfers or other events. If an unauthorized party is successful in obtaining trade secrets, PII, confidential, or otherwise protected information of our dealerships, our customers or our employees or in disrupting our operations through a cyberattack, the attack could result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer or vendor relationships, satisfaction or loyalty. In addition, security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, administrative, civil or criminal investigations or actions, any of which could have a material adverse effect on our business, results of operations or financial condition. Likewise, our business could be significantly disrupted if (i) the DMS fails to integrate with other third-party information systems, customer relations management tools or other software, or to the extent that any of these systems become unavailable to us or fail to perform as designed for an extended period of time or (ii) our relationship with our DMS providers or any other third-party provider deteriorates.

17

Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems (the “CDK Incident”). CDK provides clients in the automotive industry, including our dealerships in the U.S., with a software as a service platform (“SaaS platform”) used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK’s platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK’s dealers’ systems were fully back online. We also do not