GROUP 1 AUTOMOTIVE INC

Except as set forth below, during the Current Year, there were no changes to the Risk Factors disclosed in Item 1A. Risk Factors of our 2023 Form 10-K.

We rely on third-party vendors and suppliers for key components of our business.

Many components of our business, including data management, key operational processes and critical customer systems, are provided by or licensed from various third-party vendors and suppliers. In addition, we also rely on third-party vendors to supply key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect their ability to serve us and our customers. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted.

A failure of any of our information systems or those of our third-party service providers or a cybersecurity incident, including loss or unauthorized access of confidential information or personally identifiable information (“PII”) about our customers or employees, could negatively affect our business, operations and financial condition.

We depend on the efficient operation of our information systems and those of our third-party service providers and rely on information systems at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. Such PII is primarily collected at our dealerships and through our Acceleride® platform via an online DMS. A security incident to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although companies across all industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks.

Despite these measures and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, malware, lost or misplaced data, programming errors, scams, ransomware, burglary, human errors, acts of vandalism, misdirected wire transfers or other events. If an unauthorized party is successful in obtaining trade secrets, PII, confidential, or otherwise protected information of our dealerships or our customers or in disrupting our operations through a cyberattack, the attack could result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer or vendor relationships, satisfaction or loyalty. In addition, security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, administrative, and civil or criminal investigations or actions, any of which could have a material adverse effect on our business, results of operations or financial condition. Likewise, our business could be significantly disrupted if (i) the DMS fails to integrate with other third-party information systems, customer relations management tools or other software, or to the extent that any of these systems become unavailable to us or fail to perform as designed for an extended period of time or (ii) our relationship with our DMS providers or any other third-party provider deteriorates.

Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems. CDK provides clients in the automotive industry, including our dealerships in the U.S., with a SaaS platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK’s platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK’s dealers’ systems were fully back online. We also do not believe that the CDK Incident resulted in a breach of any PII about our customers or employees. Our dealerships in the U.K. do not use CDK’s dealers’ systems and were therefore not impacted by the CDK service outage. As a consequence, while we do not expect the CDK Incident to have a material impact on our overall financial condition or on its ongoing results of operations, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.

We are subject to automotive and other laws and regulations, which, if we are found to have violated, may adversely affect our business and results of operations.

A number of laws and regulations applicable to automotive companies affect our business and conduct, including, but not limited to, our sales, operations, financing, insurance, advertising and employment practices. Other rules such as franchise laws and regulations, consumer protection laws and other extensive laws and regulations apply to new and used motor vehicle dealers. Additionally, in every jurisdiction in which we operate, we must obtain various permits and licenses in order to conduct our business. Any failure to comply with these laws and regulations may result in administrative, civil or criminal penalties, the imposition of investigatory remedial obligations or the limitations on certain aspects of our operations.

In the U.K., the Financial Conduct Authority (the “FCA”) regulates financial services firms and financial markets, including our activities in acting as broker for the financing of vehicle sales. In January 2024, the FCA announced that it planned to undertake a formal review into the historic use of discretionary commission arrangements (“DCAs”) amid concerns that the practice of linking brokers’ commissions to the interest rate charged to customers may have been unfair to customers, resulting in customers paying too much for their car loans.

Additionally in the U.K., on October 25, 2024, the U.K. Court of Appeal issued a judgment in the three joined appeals for Johnson v Firstrand Bank Ltd, Wrench v Firstrand Bank Ltd and Hopcraft v Close Brothers Ltd (collectively, the “COA litigation”), finding that the claimants in those cases are entitled to be paid a sum equivalent to the undisclosed commission paid by their lenders to the dealerships from which they acquired their cars plus interest. Underlying the Court’s judgment were the findings that, among other things, brokers owe fiduciary and/or disinterested duties to customers, which, among other things, require disclosure to the customer of the rate and amount of the commission paid and the basis for its calculation. As a result, the failure to provide such full commission disclosure effectively results in the failure to obtain a customer’s fully informed consent to the payment of commission. The judgment also appears to extend beyond DCAs to address all commission disclosures generally. Finally, the U.K. Court of Appeal held where there is a failure to disclose, lenders and dealerships who acted as brokers are jointly and severally liable for the repayment of the commission.

The final outcomes of the FCA’s DCA review and the COA litigation, including an anticipated appeal thereof to The Supreme Court of the United Kingdom, are uncertain. Any judicial outcome or regulatory redress scheme, which ultimately results in a wider legal or regulatory requirement to refund historical commissions paid to us, could materially and adversely affect our U.K. operations.