F500 Auto & Dealerships · Automotive Retailing, Services · Regulatory action + Data breach
Penske Automotive
Headline
One of the six large dealership groups that disclosed the June 2024 CDK Global ransomware disruption to the SEC.
One of the six large dealership groups that disclosed the June 2024 CDK Global ransomware disruption to the SEC. The consumer-facing point is that a car buyer's exposure had nothing to do with which dealership group they chose - CDK controlled about half the dealer management software market, and the attack reached 15,000 locations at once. Estimated dealer losses across the industry ran from roughly $605 million to over $1 billion, with new-vehicle sales down 7.2% year over year that June.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
Not independently confirmed this pass with a company-specific data-privacy lawsuit or breach. A large multi-brand dealership group; similarly recommend checking against the AutoNation/CarMax pattern.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. Penske disclosed the June 2024 CDK Global disruption to the SEC. | fact | supported | none recorded |
| 2. Six large dealership groups disclosed the disruption to the SEC. | fact | contradicted | 1 (0 confirmed) |
| 3. The CDK Global disruption was a ransomware attack in June 2024. | fact | supported | none recorded |
| 4. A car buyer's exposure had nothing to do with which dealership group they chose. | characterization | n/a | none recorded |
| 5. CDK controlled about half the dealer management software market. | fact | unsupported | none recorded |
| 6. The attack reached 15,000 locations at once. | fact | unknown | 1 (1 confirmed) |
| 7. Estimated industry dealer losses ran from roughly $605 million. | fact | unsupported | 1 (0 confirmed) |
| 8. Estimated industry dealer losses ran to over $1 billion. | fact | supported | none recorded |
| 9. New-vehicle sales were down 7.2% year over year in June 2024. | fact | unsupported | 1 (0 confirmed) |
1 of 9 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| reporting · 2024-07-17 www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened | Claim 2 | Unassigned | corrected | “Large car-dealership companies reported disruptions to the U.S. Securities and Exchange Commission (SEC)” Quote basis: not recorded. |
| reporting · 2024-07-17 www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened | Claim 6 | Unassigned | confirmed | “Approximately 15,000 auto dealer locations across North America were affected, including both the U.S. and Canada.” Quote basis: not recorded. |
| none | Claim 7 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 9 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy See Penske Automotive's own published privacy policy | Not fetched yet | NOT CONFIRMED |
| Terms of service See Penske Automotive's own published terms of service | Not fetched yet | NOT CONFIRMED |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.