GROUP 1 AUTOMOTIVE INC

This 10-K Item 1C filing describes the registrant's cybersecurity risk management processes, including risk assessment, incident response, training, access controls, and encryption. The company states it is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. No specific breach incident is disclosed.

On June 19, 2024, Group 1 Automotive, Inc. was informed of a cybersecurity incident at CDK Global LLC, its SaaS dealer management system provider. The CDK incident caused service outages disrupting Group 1's U.S. dealership business applications. U.K. dealerships were unaffected. Group 1 activated cyber incident response procedures and isolated its systems from CDK's platform. U.S. dealerships continued operating using alternative processes. Filed as Item 8.01 (Other Events).

On November 1, 2018, Group 1 Automotive, Inc. experienced a data security incident where personal information of some employees was inadvertently and temporarily exposed to the administrator of another Paylocity client due to a misdelivery error. The exposed information included names and Social Security numbers. The information was not viewed or compromised. Paylocity investigated, provided supplemental training, and implemented systemic fixes. Affected individuals were offered 12 months of identity protection.