FEDERALItem 8.01 · voluntaryThird-Party / Supply ChainRetail & ConsumerRetailSupply Chain (3P Vendor)LowActive

LITHIA MOTORS INC

bd_e38879e27c8f570a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 19, 2024

Filed

Jun 24, 2024

To disclose

5 days

Affected

Not disclosed

Confidence

67%

Full breach record for LITHIA MOTORS INC →2 incidents on file

Lithia Motors, Inc. filed an 8-K on June 24, 2024, reporting a cybersecurity incident involving third-party provider CDK Global. On June 19, 2024, CDK notified Lithia that its systems were suspended due to a cyber incident. Lithia severed connections to CDK, causing operational disruptions to its dealer management, CRM, and inventory systems. The Company stated it has not identified any unauthorized access to its own systems.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 days

Jun 19, 2024

Discovered

Jun 24, 2024

Filed

vs. sector median

7 wks faster

Part of CDK GLOBAL II LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: LITHIA MOTORS INC
norm: lithia motors
SEC CIK: 0001023128

Name: LITHIA MOTORS INC
norm: lithia motors
SEC CIK: 0001023128
Industry: Retail & Consumerllm

Discovered: Jun 19, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Third party: via CDK Global
Initial access: supply_chain

During the incident: Activated its cyber incident response procedures
Taking precautionary containment steps
Severing business service connections between the Company's systems and CDK's
Changes made: Implemented mitigation plans to minimize disruptions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1023128/000102312824000079/lad-20240619.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 24, 2024
Raw hash: 429906f9cbbc43e2b969d1d3df07d2b98a3699fc2de61e94beae8a4f8c6c5ee4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html27.6 KB

Download View at source

Reporting entityLITHIA MOTORS INC

Victim entityLITHIA MOTORS INC

Incidentdiscovered Jun 19, 2024

Stated responseActivated its cyber incident response procedures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing