GROUP 1 AUTOMOTIVE INC
Jun 2024 · Graded Verified · Retail and Consumer · Government record
Incident summary
GROUP 1 AUTOMOTIVE INCJun 2024
$5.9M
Spent responding & recovering
Direct expense
Group 1's U.S. dealerships ran sales, service, and back office through CDK, so when a ransomware crew took the vendor dark, thousands of storefronts went dark with it. The failure was not a breach of Group 1's network but a single point of dependence: the dealer management platform was the business, and someone else owned it. No records are believed to have left, only the uptime; the company booked $10 million in insurance for a spine it had outsourced.
Verified: the linked document states this figure.
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware
Quantified 235 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.