Sonic Automotive says ransomware-linked CDK software outage cost it $30M

One of the US's largest car dealerships says the IT outage caused by CDK Global's June ransomware attack cost it approximately $30 million.

Sonic Automotive filed a Form 8-K with the Securities and Exchange Commission (SEC) on Monday alongside the release of its quarterly financials, confirming that like its rivals, it too was materially affected by the incident at CDK.

Of the total $30 million drop in pre-tax GAAP income, $11.6 million of that related to additional compensation paid to staff, and possibly external contractors, who helped to handle the outage, it said.

The outfit was still profitable, however, though the total loss diluted per-share earnings by $0.64 – a substantial hit on the $1.18 it would have been without the incident – and that's not "taking into account any potential recoveries related to the Incident and after factoring in estimated lost income and expenses attributable to the incident," the 8-K reads.

The CDK outage only accounted for the final 12 days of Sonic's second quarter, but despite being largely recovered by that time, it said work continued into July to work around the various lingering software-related disruptions. The company didn't say if Q3's earnings would also be impacted as a result.

The shareholders are hardly hurting, however, and the earnings hit didn't shake investor confidence in the car dealership as shares rose more than 12 percent on Monday. The positive reaction from the market was likely influenced by strong performance in other areas.

For example, without the CDK incident, the $1.18 EPS would have represented an 82 percent YoY increase. Its EchoPark subsidiary, another used car dealership, also reported a 91 percent increase in YoY gross profit, with the division's adjusted EBITDA also up 123 percent.

"Overall, the Sonic Automotive team continued to execute at a high level, despite operational challenges in the last 12 days of the second quarter as a result of the previously announced CDK Global software outage," said David Smith, chairman and CEO at Sonic Automotive.

"As of today, Sonic's access to the information systems provided by CDK has been restored, however, we experienced operational disruptions throughout July related to the functionality of certain CDK customer lead applications, inventory management applications, and related third-party application integrations with CDK."

Like Sonic, competitors Ashbury Automotive Group, AutoNation, and Group 1 Automotive all reported notable impacts to their bottom lines in their Q2 earnings reports.

Ashbury didn't tie any specific sums to the incident, but said it currently estimates a negative impact to the tune of $0.95-1.15 per diluted share. Its quarterly net income was $28 million ($1.39 EPS) – an 86 percent decrease from Q2 2023.

AutoNation said the CDK outage put a dampener on an otherwise strong quarter and previously said it was still facing IT disruption in late July. It said its EPS took a hit of an estimated $1.55 to $3.99, a big decrease compared to $6.29 in Q2 last year.

Group 1 was not only affected by CDK's outage but also Texas' extreme weather events this summer, but undeterred, reported results that exceeded many expectations. Its net income took a hit as a result of the adverse trading conditions but posted record quarterly revenues in various parts of its US business.

Penske and Lithia Motors were also affected by CDK but neither addressed the incident and IT disruption in any meaningful way in their results.

The decline in financial results for some of the car dealerships was expected, as is often the case when major IT disruption impacts a business.

So after the incident unraveled, economic consultants at Anderson Economic Group estimated the total losses for CDK customers to be well into the hundreds of millions per week, rising as the disruption continued. By mid-July, it believed franchised dealerships lost out on 56,200 vehicle sales and over $1 billion in revenue. ®