2024-06-24 LITHIA MOTORS INC Cybersecurity Incident

Page last updated on June 24, 2024

LITHIA MOTORS INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2024-06-24 09:00:15 EDT.

Company Summary

Lithia Motors is an automotive dealership network headquartered in Medford, Oregon.

Incident Details

Material: Unknown
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date:
Detected Date: 2024-06-19
Disclosure Date: 2024-06-24
Contained Date:
Recovered Date:

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2024-06-24

LITHIA MOTORS INC filed an 8-K at 2024-06-24 09:00:15 EDT
Accession Number: 0001023128-24-000079

Item 8.01 Other Events.

On June 19, 2024, Lithia Motors, Inc. (the “Company”) received notice from CDK Global (“CDK”), a third-party provider of certain information systems used by the Company, that CDK had suspended systems used by the Company in response to a cybersecurity incident impacting CDK. In response, the Company activated its cyber incident response procedures, which included taking precautionary containment steps and severing business service connections between the Company’s systems and CDK’s. As a result, the Company experienced disruptions in North America to its CDK hosted dealer management system, which supports dealership operations including those supporting sales, its customer relationship management system, inventory and accounting functions. To date, the Company has not identified any compromise or unauthorized access of its systems or networks.

The Company, whose dealerships continue to operate, has implemented mitigation plans to minimize disruptions and continue serving its customers. While this incident has had, and is likely to continue to have, a negative impact on the Company’s business operations until the relevant systems are fully restored, the Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

The information provided in this report is preliminary and is based on currently available information and is subject to change during the course of CDK’s and the Company’s ongoing investigation of the incident.

Company Information