PENSKE AUTOMOTIVE GROUP INC

In addition to the information set forth in this Form 10-Q, you should carefully consider the risk factors discussed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2023, and Part II, Item 1A. "Risk Factors" in our Quarterly Report on Form 10-Q for the quarterly period ended March 31, 2024, along with our other periodic reports filed with the Securities and Exchange Commission, which could materially affect our business, financial condition, or future results. The following disclosure further updates the risk factors included in our 2023 Annual Report on Form 10-K and the risk factors included in our Quarterly Report on Form 10-Q for the quarterly period ended March 31, 2024:

General Risks

We rely on third parties for the majority of our information systems and the availability and efficient operation of such systems are critical to the operation of our business.

Our information systems are fully integrated into our operations, and we rely on them to operate effectively, including with respect to electronic interfaces with manufacturers and other vendors, customer relationship management, sales and service efforts, data storage, and financial and operational reporting. The majority of our systems are provided by or licensed from third-party vendors and suppliers; the most significant of which are the dealer management systems (“DMS”) used across our retail operations and which are provided by a limited number of suppliers. We also rely on third-party vendors to supply other key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, ransomware demands, programming errors, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect the vendors’ ability to provide services to us and our customers. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted, and such failures may lead to broader disruptions or failures across our information systems which may expose us to customer, employee, manufacturing partner or third-party claims or other legal liabilities.

The failure of our information systems, the failure to protect the integrity of these systems, or the interruption of these systems as discussed herein or otherwise due to natural disasters, power loss, unexpected termination of our agreements, cyber-attacks, ransomware encryptions, or other reasons such as those which resulted from the CDK Cybersecurity Incident (described below), could significantly and adversely disrupt our business operations, impact our sales, service, inventory, customer relationship management, and accounting functions and otherwise adversely affect our results of operations. For example, on June 19, 2024, we became aware that CDK Global, LLC (“CDK”), a third-party provider of information systems, including DMS software to support retail automotive and commercial truck dealership operations, was experiencing a cybersecurity incident and its systems were rendered inoperable (the “CDK Cybersecurity Incident”). Although we do not utilize CDK's DMS in our U.S. or international automotive dealership operations, our Premier Truck Group business does utilize CDK’s dealer management system and was impacted by the CDK Cybersecurity Incident. In response to the CDK Cybersecurity Incident, we immediately took precautionary containment steps to protect our systems and commenced an investigation of the incident. PTG implemented its business continuity response plans and continued to operate without the DMS at all locations through manual or alternate processes developed to respond to such incidents. On July 2, PTG was able to reconnect all of its locations to CDK’s DMS servers and restore core functionality of the software platform.

Even where business continuity responses and contingency plans, such as those noted above, are implemented to minimize disruptions caused by information systems failures, such mitigation efforts may result in decreased operational efficiencies and limit dealership productivity. Further, despite our efforts to assess, identify, and manage material risks from cybersecurity threats to our business and operations, including through evaluating key partners and third parties with whom we share our information as well as certain customer and employee information, we may not be able to protect our various systems from disruptions.

Cybersecurity. In the ordinary course of our business, we receive confidential information about our customers, employees, associates, and vendors. We collect, process, retain, and in some cases share this information in the normal course of our business, and such information is collected and stored primarily in our core information systems, including our DMS platforms. Our internal and third-party systems, including our DMS and customer relationship management systems, are under a heightened level of risk from state actors, cyber criminals or other individuals with malicious intent to gain unauthorized access to our systems and exploit the information, including the confidential information of our customers and employees, that we gather. Cyber-attacks, such as the CDK Cybersecurity Incident described above, and threats to information systems and network and data security are becoming increasingly diverse and sophisticated, with attacks increasing in frequency, scope, and potential harm. In addition, some of our software applications are utilized by third parties who, in turn, subcontract or otherwise outsource various processes and administrative functions to additional third parties. Such third parties may have access to confidential information that is critical to our business operations and services. While our information security program includes enhanced controls to monitor third party providers' security programs, these third parties are subject to their own risks of data breaches, cyber-attacks, and other events or actions that could damage, disrupt, or close down their networks or systems, which in turn may adversely impact our business operations.

Despite the security measures we have in place or may implement in the future, we may be unable to fully detect, mitigate, or protect against cyber-attacks, ransomware attacks, computer viruses, security breaches, social engineering, malicious software, lost or misplaced data, programming errors, human errors, burglary, acts of vandalism, misdirected wire transfers or other events impacting us or our third-party service providers. Any security breach or event, whether by us directly or our third-party service providers, may result in an authorized party obtaining trade secrets, personally identifiable information or confidential information and may result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer, vendor or manufacturer relationships, and have other negative operational impacts. In addition, such security breaches or events resulting in the loss or exposure of this information could result in liabilities and other significant financial exposures, including those derived from investigations, regulatory fines, penalties for violations of applicable laws and regulations, costs related to the remediation of ransomware events, litigation including consumer class actions, the imposition of penalties, or other means, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our failure to respond quickly and appropriately to such a security breach, or our failure to adequately test and verify the remediation of security incidents involving third parties prior to reintegration into our information systems, could exacerbate the consequences of the breach.