Sonic Automotive: CDK suspended certain systems after cyber incident

In a regulatory filing, Sonic Automotive disclosed that on June 19, a third-party provider of certain information systems used by Sonic Automotive notified its dealership customers that CDK had suspended certain systems, including systems used by the company, in response to a cybersecurity incident impacting CDK. As a result, the company experienced disruptions to its dealer management system hosted by CDK, which supports critical dealership operations including those supporting sales, inventory and accounting functions and its customer relationship management system. All of the company’s dealerships are open and operating utilizing workaround solutions to minimize the disruption caused by this CDK outage. Upon detection of the unauthorized activity, the company immediately took precautionary containment steps to protect the company’s systems and commenced an investigation of the incident. As the incident is ongoing, the full scope, nature and impact of the incident, including the extent to which the threat actor accessed any customer data, are not yet known. While this incident has had, and is likely to continue to have, a negative impact on the company’s business operations until the relevant systems are fully restored, the company has not yet determined whether the incident is reasonably likely to have a material impact on the company’s financial condition or results of operations.