SONIC AUTOMOTIVE INC

Previous wording

We have, and may again in the future, experienced material negative impacts on our business and results of operations as a result of a cybersecurity incident. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain of our systems in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to the Affected Systems, which negatively impacted our ability to conduct sales, track inventory, coordinate business functions and otherwise efficiently execute our business operations. As a result of the CDK outage, we experienced a material negative impact on our business and results of operations during the second fiscal quarter of 2024.

Current wording

We have experienced, and may again in the future experience, material negative impacts on our business and results of operations as a result of a cybersecurity incident. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain systems used by us in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to the affected systems, which negatively impacted our ability to conduct sales, track inventory, coordinate business functions and otherwise efficiently execute our business operations. As a result of the CDK outage, our business and results of operations during the second and third fiscal quarters of 2024 were adversely affected.

Previous wording

Although we are working with CDK and taking steps to strengthen our systems infrastructure, there can be no assurance that we will not be affected by another cyberattack or other cybersecurity incident affecting our information systems, including those provided to us by third-parties. We remain exposed to the risk of additional interruptions of service or loss of access to systems (including our internal or externally hosted business applications) supporting our critical business functions and processes, which may negatively affect our ability to deliver vehicles or complete transactions with customers; unauthorized access or theft of customer or employee personal confidential information, including financial information, or strategically sensitive data; disruption of communications (both internally and externally) that may affect the quality of information used to make informed business decisions; additional costs and expenses; and damage to our reputation. Any cybersecurity breach or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, lost sales or damage to our reputation, and otherwise cause a loss of confidence in our services, which could materially adversely affect our competitive position, results of operations and financial condition.

Current wording

Although we are working with CDK and other information technology vendors and taking steps to strengthen our systems infrastructure, there can be no assurance that we will not be affected by another cyberattack or other cybersecurity incident affecting our information systems, including those provided to us by third parties. We remain exposed to the risk of additional interruptions of service or loss of access to systems (including our internal or externally hosted business applications) supporting our critical business functions and processes, which may negatively affect our ability to deliver vehicles or complete transactions with customers; unauthorized access or theft of customer or employee personal confidential information, including financial information, or strategically sensitive data; disruption of communications (both internally and externally) that may affect the quality of information used to make informed business decisions; additional costs and expenses; and damage to our reputation. Any cybersecurity breach or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, lost sales or damage to our reputation, and otherwise cause a loss of confidence in our services, which could materially adversely affect our competitive position, results of operations and financial condition.