Cybersecurity Policy Report, Auto Dealers File Disclosures With SEC on Ransomware Attack, (Jun 25, 2024)
Organizations Mentioned:Autonation, Inc. | Group 1 Automotive, Inc. | Lithia Motors, Inc. | Penske Automotive Group, Inc. | Sonic Automotive, Inc.
By Tony Foley
In a flurry of filings with the Securities and Exchange Commission last week, several auto dealers have outlined the potential impact of the hack of a third-party information systems provider used by the companies.
The auto dealers (Group 1 Automotive, Inc., AutoNation, Inc., Lithia Motors, Inc., Sonic Automotive, Inc., and Penske Automotive Group, Inc.) each filed a Form 8-K with the SEC between June 19 and June 21 stating that they had used CDK Global for specified information services. In each filing, the companies disclosed that they received notice from CDK on June 19 that it had suspended systems used by the dealers in response to a cybersecurity incident impacting CDK. The companies used CDK’s platform to manage customer relationships, sales, financing services, inventory, and back office operations. The filings said the cybersecurity incident suffered by CDK disrupted the dealers’ business operations in the U.S., which were reliant on CDK’s information systems.
The filings reveal that the dealers each took independent steps to conduct business until CDK’s systems are restored and that the disruptions caused by the incident response harmed business operations. Until the incident is resolved, they said, it’s unclear whether the incident will have a material impact on the companies’ financial conditions.
The companies each reported the incident under Form 8-K Item 8.01, Other Events, rather than under Item 1.05, which was recently added to Form 8-K pursuant to regulations requiring regulated companies to report material cybersecurity incidents. It’s likely that the companies were influenced by a statement issued by Eric Gerding, director of the SEC’s Division of Corporate Finance, in May in which he stated that investors may be confused if companies disclosed cybersecurity incidents using Item 1.05 if a materiality determination hadn’t been made. Rather, he suggested, companies should utilize Item 8.01 if the incident is either immaterial or if the company has not made a materiality determination. If the incident is later determined to be material, companies should then file an amended 8-K using Item 1.05 to disclose that finding within four business days, as required under the new rules (CPR, May 22).
News: FederalLegislation DataSecurity DataBreach