Sonic Automotive Inc., one of America’s largest car dealers, recently reported that its Q1-2025 net income reached $70.6 million, “up 68% year-over-year.” But that increase “includes the effect of a $30.0 million pre-tax gain” from a cyber insurance settlement, the company (NYSE:SAH) noted in an April 24th press release. Sonic had recognized another, related $10 million insurance settlement payment last year.
Claims from Hack of Software Provider CDK Global
Sonic reported the cyber insurance settlements stemmed from claims involving the hack last year of CDK Global, a provider of software to some 15,000 car dealers. “In connection with the CDK outage, we recognized $10.0 million in income from cyber insurance proceeds during the three months ended December 31, 2024, and $30.0 million in income from cyber insurance proceeds during the three months ended March 31, 2025, which was recorded as a reduction to Selling, general and administrative expenses,” according to the firm’s 10-Q report for the quarter ending March 31, 2025, filed on April 24th.
CDK had to suspend some of its services after what was reported as a ransomware attack by an Eastern European hacking gang. In June 2024 Sonic filed a cyber incident 8-K report (pursuant to a sometimes controversial SEC regulation), revealing that “On June 19, 2024, CDK Global (“CDK”), a third-party provider of certain information systems used by Sonic Automotive, Inc. (the “Company”), notified its dealership customers that CDK had suspended certain systems, including systems used by the Company, in response to a cybersecurity incident impacting CDK. As a result, the Company experienced disruptions to its dealer management system (“DMS”) hosted by CDK, which supports critical dealership operations including those supporting sales, inventory and accounting functions and its customer relationship management (“CRM”) system. All of the Company’s dealerships are open and operating utilizing workaround solutions to minimize the disruption caused by this CDK outage.”
Expenses from Additional Compensation to Staff
Sonic later reported a “$30 million drop in pre-tax GAAP income, $11.6 million of that related to additional compensation paid to staff, and possibly external contractors, who helped to handle the outage,” according to an August 2024 report in The Register. That report listed Group 1 Automotive, Lithia Motors, and Penske Automotive Group as other dealers impacted by the attack, which may have caused $1 billion in lost sales among CDK’s customers. Not surprisingly, lawsuits have been reported in connection with the incident.
Setting aside the cyber insurance claims and settlements, CDK software must be valuable to dealers, as Sonic extended its relationship with CDK not long after the hack.
