Group 1 Automotive (GPI) Risk Analysis

We depend on the efficient operation of our IT and those of our third-party service providers and rely on IT at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S. and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. PII is primarily collected at our dealerships and through our digital platform via an online DMS. A cybersecurity attack to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although companies across all industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks, as well as policies governing the deletion of PII, to limit the information exposed to a potential cyberattack. Despite these measures and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, malware, lost or misplaced data, programming errors, scams, ransomware, burglary, human errors, acts of vandalism, misdirected wire transfers or other events. If an unauthorized party is successful in obtaining trade secrets, PII, confidential, or otherwise protected information of our dealerships, our customers or our employees or in disrupting our operations through a cyberattack, the attack could result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer or vendor relationships, satisfaction or loyalty. In addition, security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, administrative, civil or criminal investigations or actions, any of which could have a material adverse effect on our business, results of operations or financial condition. Likewise, our business could be significantly disrupted if (i) the DMS fails to integrate with other third-party IT, customer relations management tools or other software, or to the extent that any of these systems become unavailable to us or fail to perform as designed for an extended period of time or (ii) our relationship with our DMS providers or any other third-party provider deteriorates. Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK's dealers' systems (the "CDK Incident"). CDK provides clients in the automotive industry, including our dealerships in the U.S., with a software as a service platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK's platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK's dealers' systems were fully back online. We also do not believe that the CDK Incident resulted in a breach of any PII about our customers or employees. Our dealerships in the U.K. do not use CDK's dealers' systems and were therefore not impacted by the CDK service outage. As a consequence, we do not expect the CDK Incident to have a material impact on our overall financial condition or on its ongoing results of operations. However, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.