PENSKE AUTOMOTIVE GROUP INC

As part of our business model, we receive sensitive information regarding customers, employees, associates, and vendors from various online and offline channels. We collect, process, retain, and in some cases share this information in the normal course of our business. Our internal and third-party systems are under a heightened level of risk from cyber criminals or other individuals with malicious intent to gain unauthorized access to our systems and exploit the information, including sensitive personal information, that we gather. Cyber-attacks and threats to network and data security are becoming increasingly diverse and sophisticated, with attacks increasing in frequency, scope, and potential harm. In addition, some of our software applications are utilized by third parties who provide outsourced administrative functions. Such third parties may have access to confidential information that is critical to our business operations and services. While our information security program includes enhanced controls to monitor third party providers' security programs, these third parties are subject to their own risks of data breaches, cyber-attacks, and other events or actions that could damage, disrupt, or close down their networks or systems, which in turn may adversely impact our business operations. For an overview of certain of our efforts related to cybersecurity risk management, strategy, and governance and our written Information Security Program, see Item 1C. Cybersecurity.

Despite the security measures we have in place, we may be unable to fully detect, mitigate, or protect against cyber-attacks, ransomware attacks, security breaches, social engineering, malicious software, lost or misplaced data, programming errors, human errors, acts of vandalism, or other events. Many companies have disclosed security breaches involving sophisticated cyber-attacks and ransomware attacks that were not recognized or detected until after such companies had been affected, notwithstanding the preventive measures they had in place. Any security breach or event resulting in the misappropriation, loss, or other unauthorized disclosure of confidential information or degradation of services provided by critical business systems, whether by us directly or our third-party service providers, could adversely affect our business operations, sales, reputation with current and potential customers, associates or vendors as well as other operational and financial impacts derived from investigations, litigation, the imposition of penalties, or other means. In addition, our failure to respond quickly and appropriately to such a security breach could exacerbate the consequences of the breach and efforts to prevent, detect, and mitigate data breaches and cyber-attacks subject us to additional costs.