2024-06-24 GROUP 1 AUTOMOTIVE INC Cybersecurity Incident

Page last updated on September 29, 2025

GROUP 1 AUTOMOTIVE INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2024-06-24 07:05:49 EDT.

Company Summary

Group 1 Automotive owns and operates about 130 franchises at approximately 100 dealerships, as well as about 25 collision service centers.

Incident Details

Material: No
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date: Unknown
Detected Date: 2024-06-19
Disclosure Date: 2024-06-24
Contained Date: Unknown
Recovered Date: Unknown

Attack Goal: Unknown
Attack Tactics¹: TA0042
Attack Techniques¹: T1195

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2024-06-24

GROUP 1 AUTOMOTIVE INC filed an 8-K at 2024-06-24 07:05:49 EDT
Accession Number: 0001031203-24-000048

Item 8.01 Other Events.

On June 19, 2024, Group 1 Automotive, Inc. ("Group 1" or the "Company") was informed of a cybersecurity incident experienced by CDK Global LLC ("CDK"), which resulted in service outages on CDK's dealers' systems (the "CDK incident"). CDK provides clients in the automotive industry, including Group 1 dealerships in the U.S., with a software as a service ("SaaS") platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. The CDK incident has disrupted the Company's business applications and processes in its U.S. operations that rely on CDK's dealers' systems.

In response to the CDK incident, Group 1 immediately activated its cyber incident response procedures and proactively took measures to protect and isolate its systems from CDK's platform. Despite the CDK service outage, all Group 1 U.S. dealerships continue to conduct business using alternative processes until CDK's dealers' systems are available. The Company's dealerships in the U.K. do not use CDK's dealers' systems and are therefore not impacted by the CDK service outage.

CDK has advised that it anticipates the restoration of the dealer management system will require several days and not weeks. The timing of the restoration of other impacted CDK applications remains unclear at this time. Group 1's ability to determine the material impact, if any, of the CDK incident and the resulting service outage, will ultimately depend on a number of factors, including when, and to what extent, the Company resumes its access to the CDK's dealers' systems.

A copy of the Company's press release regarding the CDK incident is attached hereto as Exhibit 99.1.

Exhibit No. 99.1

Press release of Group 1 Automotive, Inc., dated as of June 24, 2024.

Group 1 Automotive Provides Statement on CDK Cybersecurity Incident HOUSTON, TX, June 24, 2024 - Group 1 Automotive, Inc. (NYSE: GPI) ("Group 1" or the "Company"), a Fortune 300 automotive retailer with 202 dealerships located in the U.S. and U.K., today announced that the cybersecurity incident recently experienced by third-party software provider, CDK Global LLC ("CDK"), has disrupted Group 1's business applications and processes in its U.S. operations that rely on CDK's dealers' systems. In response, the Company immediately activated its cyber incident response procedures and proactively took measures to protect and isolate its systems from CDK's platform. Despite the CDK service outage, all Group 1 U.S. dealerships continue to conduct business using alternative processes until CDK's dealers' systems are available. The Company's dealerships in the U.K. do not use CDK's dealers' systems and are therefore not impacted by the CDK service outage. CDK has advised that it anticipates the restoration of the dealer management system will require several days and not weeks. The timing of the restoration of other impacted CDK applications remains unclear at this time. Group 1's ability to determine the material impact, if any, of the CDK incident and the resulting service outage, will ultimately depend on a number of factors, including when, and to what extent, the Company resumes its access to CDK's dealers' systems. Group 1 is closely monitoring this situation and will take additional action if determined necessary. "Our associates are coming together with an unwavering focus on delivering the best possible customer experience. Their efforts have been nothing short of exemplary. We'd like to thank our team, our customers, and our partners for their patience as we navigate this outage." said Daryl Kenningham, Group 1's President and Chief Executive Officer.

Company Information