SONIC AUTOMOTIVE INC

Current report

Security breaches and other disruptions to our information systems could compromise our confidential, competitive or otherwise sensitive information and expose us to liability, disrupt our business operations and otherwise negatively affect our business, including our reputation, results from operations and financial condition.

Current report

We have invested in internal and external business applications to execute our strategy of employing technology to benefit our business. In the ordinary course of business, we collect and store sensitive data, including intellectual property, our proprietary business information and that of our customers, suppliers and business partners, and personally identifiable information of our customers and employees. Moreover, we utilize third-party software, systems and services to support critical dealership operations. The frequency and severity of cybersecurity incidents has increased in recent years and adversely impacted organizations of varying sizes. Although we have attempted to mitigate the cybersecurity risk of both our internal and outsourced functions by implementing various cybersecurity controls, an internal framework for the oversight of cybersecurity risks and other security measures, specifically as described in “Item 1C. Cybersecurity” of our Annual Report on Form 10-K for the year ended December 31, 2023, our information technology and infrastructure, including the systems that are provided to us by third-parties, have been, and may in the future be, vulnerable to attacks by hackers or breaches due to employee error, malfeasance or other disruptions.

Current report

We have, and may again in the future, experienced material negative impacts on our business and results of operations as a result of a cybersecurity incident. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain of our systems in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to the Affected Systems, which negatively impacted our ability to conduct sales, track inventory, coordinate business functions and otherwise efficiently execute our business operations. As a result of the CDK outage, we experienced a material negative impact on our business and results of operations during the second fiscal quarter of 2024.

Current report

Although we are working with CDK and taking steps to strengthen our systems infrastructure, there can be no assurance that we will not be affected by another cyberattack or other cybersecurity incident affecting our information systems, including those provided to us by third-parties. We remain exposed to the risk of additional interruptions of service or loss of access to systems (including our internal or externally hosted business applications) supporting our critical business functions and processes, which may negatively affect our ability to deliver vehicles or complete transactions with customers; unauthorized access or theft of customer or employee personal confidential information, including financial information, or strategically sensitive data; disruption of communications (both internally and externally) that may affect the quality of information used to make informed business decisions; additional costs and expenses; and damage to our reputation. Any cybersecurity breach or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, lost sales or damage to our reputation, and otherwise cause a loss of confidence in our services, which could materially adversely affect our competitive position, results of operations and financial condition.

Current report

See Note 6, “Long-Term Debt,” to the accompanying unaudited condensed consolidated financial statements for a description of restrictions on the payment of dividends.

Previous report

The following table sets forth information about the shares of Class A Common Stock we repurchased during the three months ended March 31, 2024:

Previous report

(1)On July 28, 2022, we announced that our Board of Directors had increased the dollar amount authorized for us to repurchase shares of our Class A Common Stock pursuant to our share repurchase program. Our share repurchase program does not have an expiration date and current remaining availability under the program is as follows:

Previous report

See “Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations” for additional discussion of restrictions on share repurchases and payment of dividends.