DisclosureLens
FEDERALItem 8.01 · voluntaryHackingRetail & ConsumerRetailSupply Chain (3P Vendor)LowActive

Sonic Automotive, Inc.

bd_2af1db1ca1aea898 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 19, 2024

Filed

Jun 21, 2024

To disclose

2 days

Affected

Not disclosed

Confidence

68%
Full breach record for Sonic Automotive, Inc. →3 incidents on file

Sonic Automotive, Inc. filed an 8-K on June 21, 2024, reporting a cybersecurity incident involving third-party provider CDK Global. On June 19, 2024, CDK notified customers of a cybersecurity incident that resulted in the suspension of systems used by Sonic, including its dealer management system (DMS) and customer relationship management (CRM) system. Sonic took precautionary containment steps and commenced an investigation. The full scope and impact, including whether customer data was accessed, are not yet known. The incident is ongoing.

Incident timeline

discovery → filing · 2 days

Jun 19, 2024

Discovered

Jun 21, 2024

Filed

vs. sector median

9 wks faster

Part of CDK GLOBAL II LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.