PENSKE AUTOMOTIVE GROUP, INC.

In the ordinary course of our business, we receive confidential information about our customers, employees, associates, and vendors. We collect, process, retain, and in some cases share this information in the normal course of our business, and such information is collected and stored primarily in our core information systems, including our DMS and CRM platforms. Our internal and third-party systems, including our DMS and CRM systems, are under a heightened level of risk from state actors, cyber criminals or other individuals with malicious intent to gain unauthorized access to our systems and exploit the information, including the confidential information of our customers and employees, that we gather. Moreover, increasingly powerful artificial intelligence technologies may increase our cybersecurity risks as we and other industry participants need to respond to these novel technologies which will likely be used to thwart our defenses or to obtain personal information. Cyber-attacks, such as the CDK Cybersecurity Incident described above, and threats to information systems and network and data security are becoming increasingly diverse and sophisticated, with attacks increasing in frequency, scope, and potential harm. In addition, some of our software applications are utilized by third parties who, in turn, subcontract or otherwise outsource various processes and administrative functions to additional third parties. Such third parties may have access to confidential information that is critical to our business operations and services. While our information security program includes enhanced controls to monitor third party providers' security programs, these third parties are subject to their own risks of data breaches, cyber-attacks, and other events or actions that could damage, disrupt, or close down their networks or systems, which in turn may adversely impact our business operations. For an overview of certain of our efforts related to cybersecurity risk management, strategy, and governance and our written Information Security Program, see Item 1C. Cybersecurity.

Despite the security measures we have in place or may implement in the future, we may be unable to fully detect, mitigate, or protect against cyber-attacks, ransomware attacks, computer viruses, security breaches, social engineering, malicious software, lost or misplaced data, programming errors, human errors, burglary, acts of vandalism, misdirected wire transfers or other events impacting us or our third-party service providers. Any security breach or event, whether by us directly or our third-party service providers, may result in an authorized party obtaining trade secrets, personally identifiable information or confidential information and may result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer, vendor or manufacturer relationships, and have other negative operational impacts. In addition, such security breaches or events resulting in the loss or exposure of this information could result in liabilities and other significant financial exposures, including those derived from investigations, regulatory fines, penalties for violations of applicable laws and regulations, costs related to the remediation of ransomware events, litigation including consumer class actions, the imposition of penalties, or other means, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our failure to respond quickly and appropriately to such a security breach, or our failure to adequately test and verify the remediation of security incidents involving third parties prior to reintegration into our information systems, could exacerbate the consequences of the breach.

Property loss, business interruption, or other liabilities. Our business is subject to substantial risk of loss due to the significant concentration of property values, including vehicle and parts inventories at our operating locations; claims by employees, customers, and third parties for personal injury or property damage; and fines and penalties in connection with alleged violations of regulatory requirements. While we have insurance for many of these risks, we retain risk relating to certain of these perils, including through self-insurance, and certain perils are not covered by our insurance. Certain insurers have limited available property coverage in response to the natural catastrophes experienced in recent years. If we experience significant losses that are not covered by our insurance, whether due to adverse weather conditions or otherwise, or we are required to retain a significant portion of a loss, it could have a significant and adverse effect on us.