Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 71

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 71
---
 believe that the CDK Incident resulted in a breach of any PII about our customers or employees. Our dealerships in the U.K. do not use CDK’s dealers’ systems and were therefore not impacted by the CDK service outage. As a consequence, we do not expect the CDK Incident to have a material impact on our overall financial condition or on its ongoing results of operations. However, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.

A cybersecurity breach, including loss of confidential information or a breach of PII about our customers or employees, could negatively affect operations and result in high costs. 

In the ordinary course of business, we receive significant PII about our customers and our employees. A cybersecurity attack to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, fraud, trickery, or other forms of deception. Although many companies across many industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. We have implemented security measures that are designed to detect and protect against cyberattacks, as well as policies governing the deletion of PII, to limit the information exposed to a potential cyberattack.

Despite these measures and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, ransomware, burglary, human errors, acts of vandalism, misdirected wire transfers or other events. If an unauthorized party is successful in obtaining trade secrets, PII, confidential, or otherwise protected information of our dealerships, our customers or our employees or in disrupting our operations through a cyberattack, the attack could result in loss of revenue, increase costs of doing business, negatively affect customer satisfaction and loyalty, and expose us to negative publicity. In addition, security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, administrative,