Item 8.01. Other Events

On June 19, 2024, Lithia Motors, Inc. (the “Company”) received notice from CDK Global (“CDK”), a third-party provider of certain information systems used by the Company^¹, that CDK had suspended systems used by the Company in response to a cybersecurity incident impacting CDK^². In response, the Company activated its cyber incident response procedures, which included taking precautionary containment steps and severing business service connections between the Company’s systems and CDK’s^³. As a result, the Company experienced disruptions in North America to its CDK hosted dealer management system, which supports dealership operations including those supporting sales, its customer relationship management system, inventory and accounting functions^⁴. To date, the Company has not identified any compromise or unauthorized access of its systems or networks.^⁵

The Company, whose dealerships continue to operate, has implemented mitigation plans to minimize disruptions and continue serving its customers. While this incident has had, and is likely to continue to have, a negative impact on the Company’s business operations until the relevant systems are fully restored^⁶,⁷, the Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations^⁸,⁹.

The information provided in this report is preliminary and is based on currently available information and is subject to change during the course of CDK’s and the Company’s ongoing investigation of the incident.^¹⁰

Forward-Looking Statements

Certain statements in this report constitute forward-looking statements within the meaning of the “Safe Harbor” provisions of the Private Securities Litigation Reform Act of 1995. Generally, you can identify forward-looking statements by terms such as “project,” “outlook,” “target,” “may,” “will,” “would,” “should,” “seek,” “expect,” “plan,” “intend,” “forecast,” “anticipate,” “believe,” “estimate,” “predict,” “potential,” “likely,” “goal,” “strategy,” “future,” “maintain,” and “continue” or the negative of these terms or other comparable terms. Examples of forward-looking statements in this report include, among others, statements regarding the impact of the CDK cybersecurity incident on the Company’s business, the ability of the Company to mitigate disruptions to its operations, and the timeline for restoration of the Company’s dealer management system. Forward-looking statements are not guarantees of future performance, and our actual results of operations, financial condition and liquidity may differ materially from those made in or suggested by the forward-looking statements in this report. The risks and uncertainties that could cause actual results to differ materially from estimated or projected results include, without limitation, the Company’s discovery of additional or different information related to the incident; legal, reputational, and financial risks resulting from the incident; any potential regulatory inquiries, enforcement actions, demands and/or litigation to which the Company may become subject in connection with the incident; any disputes or loss of business, and other additional costs that may be incurred by the Company in connection with the incident, and the risks set forth in our most recent Annual Report on Form 10-K and from time to time in our other filings with the SEC. Any forward-looking statement made by us in this report is based only on information currently available to us and speaks only as of the date on which it is made. Except as required by law, we undertake no obligation to publicly update any forward-looking statement.