SONIC AUTOMOTIVE INC

There have been no material changes in our risk factors from those included in “Item 1A. Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2023, except as noted below, which replaces in its entirety, the risk factor “Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.”

Security breaches and other disruptions to our information systems could compromise our confidential, competitive or otherwise sensitive information and expose us to liability, disrupt our business operations and otherwise negatively affect our business, including our reputation, results from operations and financial condition.

We have invested in internal and external business applications to execute our strategy of employing technology to benefit our business. In the ordinary course of business, we collect and store sensitive data, including intellectual property, our proprietary business information and that of our customers, suppliers and business partners, and personally identifiable information of our customers and employees. Moreover, we utilize third-party software, systems and services to support critical dealership operations. The frequency and severity of cybersecurity incidents has increased in recent years and adversely impacted organizations of varying sizes. Although we have attempted to mitigate the cybersecurity risk of both our internal and outsourced functions by implementing various cybersecurity controls, an internal framework for the oversight of cybersecurity risks and other security measures, specifically as described in “Item 1C. Cybersecurity” of our Annual Report on Form 10-K for the year ended December 31, 2023, our information technology and infrastructure, including the systems that are provided to us by third-parties, have been, and may in the future be, vulnerable to attacks by hackers or breaches due to employee error, malfeasance or other disruptions.

We have experienced, and may again in the future experience, material negative impacts on our business and results of operations as a result of a cybersecurity incident. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain systems used by us in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to the affected systems, which negatively impacted our ability to conduct sales, track inventory, coordinate business functions and otherwise efficiently execute our business operations. As a result of the CDK outage, our business and results of operations during the second and third fiscal quarters of 2024 were adversely affected.

Although we are working with CDK and other information technology vendors and taking steps to strengthen our systems infrastructure, there can be no assurance that we will not be affected by another cyberattack or other cybersecurity incident affecting our information systems, including those provided to us by third parties. We remain exposed to the risk of additional interruptions of service or loss of access to systems (including our internal or externally hosted business applications) supporting our critical business functions and processes, which may negatively affect our ability to deliver vehicles or complete transactions with customers; unauthorized access or theft of customer or employee personal confidential information, including financial information, or strategically sensitive data; disruption of communications (both internally and externally) that may affect the quality of information used to make informed business decisions; additional costs and expenses; and damage to our reputation. Any cybersecurity breach or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, lost sales or damage to our reputation, and otherwise cause a loss of confidence in our services, which could materially adversely affect our competitive position, results of operations and financial condition.