FEDERALItem 1.05 · mandatoryHackingRetail & ConsumerRetailSupply Chain (3P Vendor)LowContained

Sonic Automotive, Inc.

bd_3dedda2d8dd5b1e9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 5, 2024

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for Sonic Automotive, Inc. →3 incidents on file

Sonic Automotive, Inc. filed an amended 8-K (Amendment No. 1) disclosing that a cybersecurity incident experienced by its third-party service provider, CDK Global, on June 19, 2024, caused material operational disruptions to Sonic's systems (DMS, CRM) throughout July 2024. The incident adversely affected Q2 2024 GAAP earnings per diluted share by approximately $0.64. Access to systems has been restored. No specific data types or individual counts were disclosed in this filing.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 19, 2024

Begins

Aug 5, 2024

Filed

Part of CDK GLOBAL II LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Sonic Automotive, Inc.
norm: sonic automotive
SEC CIK: 0001043509
Domain: sonicautomotive.com

Name: Sonic Automotive, Inc.
norm: sonic automotive
SEC CIK: 0001043509
Domain: sonicautomotive.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jun 19, 2024 – Jun 19, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via CDK Global
Initial access: supply_chain

During the incident: Restored access to information systems affected by the Incident, including its dealer management system (DMS) and customer relationship management system (CRM)
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1043509/000104350924000063/sah-20240705.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 5, 2024
Raw hash: 4c8cfda11404c36bd1649afe9e27603e34183707ae29d27f8aabc7b95337828f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html27.5 KB

Download View at source

Reporting entitySonic Automotive, Inc.

Victim entitySonic Automotive, Inc.

IncidentThird-Party / Supply Chain

Stated responseRestored access to information systems affected by the Incident, including its dealer management system (DMS) and customer relationship management system (CRM)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing