Lithia Motors

Lithia disclosed the CDK Global outage to the SEC in June 2024 - one of six large dealership groups that did. The finding is concentration: CDK's dealer management software ran roughly half the North American market, so a single ransomware attack took about 15,000 dealer locations offline simultaneously and forced pen-and-paper operation for nearly two weeks. Dealerships hold complete credit applications, income verification and driver's licence data, and in the aftermath scammers posing as CDK representatives ran phishing and social-engineering attempts against dealers and customers. Lithia is also the largest US dealership group by revenue and owns Driveway and Green Car, so its customer data spans traditional and online sales.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.