Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 69

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 69
---

We rely on third-party vendors and suppliers for key components of our business.

Many components of our business, including data management, key operational processes and critical customer systems, are provided by or licensed from various third-party vendors and suppliers. In addition, we also rely on third-party vendors to supply key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect their ability to serve us and our customers. For example, in June 2024, CDK Global LLC (“CDK”) experienced a cybersecurity event, which resulted in service outages on CDK’s dealers’ systems including our CDK DMS. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted.

A failure of any of our information systems or those of our third-party service providers or a cybersecurity incident, including loss or unauthorized access of confidential information or PII about our customers or employees, could negatively affect our business, operations and financial condition.

We depend on the efficient operation of our information systems and those of our third-party service providers and rely on information systems at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S. and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. PII is primarily collected at our dealerships and through our AcceleRide® platform via an online DMS. A cybersecurity attack to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although companies across all industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks, as well as policies governing the deletion of PII, to limit the information exposed to a potential cyberattack.

Despite these measures