CDK cyberattacks dampen public dealership groups' Q2 numbers

Five of the six publicly traded U.S. dealership groups experienced substantial fallout from the June 19 CDK Global cyberattacks that impacted their second-quarter earnings.

Lithia Motors Inc., Asbury Automotive Group, AutoNation Inc., Group 1 Automotive Inc. and Sonic Automotive Inc. said they faced particularly dramatic short-term setbacks either through large one-time costs or depressed earnings per share.

Penske Automotive Group, which uses CDK only for its Premier Truck Group, said the outage had an "immaterial" effect on its earnings.

CDK was forced to shut down its dealership management system for 15,000 customers across North America, leaving thousands of dealerships to cobble together pen-and-paper and temporary technology workarounds to keep selling and servicing vehicles.

Lithia posted diluted earnings per share of $7.87 during the second quarter. CEO Bryan DeBoer said on an Aug. 1 earnings call that the company would have generated an additional $1.10 per share were it not for disruption from the CDK outage.

Asbury posted $1.39 in diluted earnings per share during the second quarter, but the group estimated that in addition it could have produced 95 cents to $1.15 in earnings per share were it not for its CDK issues. Its net income for the quarter dropped 86 percent partly because of the outage.

AutoNation reported $32.3 million in one-time costs related to the CDK outage. The cyberattacks, along with lower average selling prices of vehicles, also led to revenue dropping $410 million to $6.5 billion, AutoNation said during its second-quarter earnings call. The dealership group previously said the shutdown would reduce its Q2 2024 earnings by $1.50 per share.

For Sonic, the CDK software outage cut second-quarter net income by about $22.2 million, including pretax charges of $11.6 million for extra compensation paid to employees related to the CDK outage.

Still, analysts said the numbers beat expectations.

J.P. Morgan, in an Aug. 6 note, said the CDK ransomware event impacted earnings per share by roughly 12 percent on average, on a non-generally accepted accounting principles basis.

But the six companies on average beat J.P. Morgan's earnings per share estimates by approximately 7 to 8 percent. Sonic and Lithia were the most ahead of its earnings consensus; AutoNation and Asbury the least, J.P. Morgan said.

The investment bank Jefferies Group said in an Aug. 5 note that Sonic and Asbury in particular faced "a significant volume of headwind" from the CDK outage. Jefferies noted, however, that both are posting better-than-forecast new gross profit per unit sold despite higher inventory and rising incentives.

Jefferies also said the six dealership groups likely won't be dealing with longer-term fallout.

"We expect this environment of healthy but moderating [gross profit per unit retailed] and recovering volumes should be an industry tailwind into [2025], while noting [the second half of 2024] still sees growing incentives, macro concern and continued affordability headwinds alongside persisting tight used supply," Jefferies said.

Beyond Asbury's depressed earnings per share, the CDK outage caused lost business and one-time expenses including overtime.

Asbury's service and parts business was particularly affected. Same-store service and parts gross profit rose 3.6 percent to $299.9 million during the second quarter, but it had been on pace for 8 percent growth during April and May, Asbury told investors.

The company's wholesale parts and collision business particularly suffered because of the CDK outage, Dan Clara, Asbury's senior vice president of operations, said on an Aug. 2 earnings call, though he did not elaborate.

CEO David Hult said during the call that many of the customers whose efforts to shop or have service work were disrupted by the outage would return to Asbury and complete the deferred transaction.

However, Hult also said Asbury had a software workaround to sell vehicles in CDK's absence, and said on the earnings call that he believed Asbury's sales volume issues during the quarter "had more to do with the [Asbury] brand mix than the outage."

Asbury, of Duluth, Ga., ranks No. 5 on Automotive News' list of the top 150 dealership groups based in the U.S., with retail sales of 149,509 new vehicles in 2023.

CEO Mike Manley said the company experienced widespread disruption from the cyberattacks.

"Virtually all of our business processes including CRM, deal processing, financial services, inventory management, after-sale systems and accounting are tied one form or another to the CDK platform and therefore we were all immediately impacted," Manley said during the company's earnings call.

"We manually processed close to 60,000 repair orders during the outage and you can imagine this slowed things down tremendously," he said.

At the same time, the impact "is now behind us" as of the last week of July, Manley said.

"Our daily focus is on fully rebuilding the momentum that we lost and regaining any share that we lost, particularly in that last period of June," he added.

AutoNation, of Fort Lauderdale, Fla., ranks No. 2 on Automotive News' list of the top 150 dealership groups based in the U.S., retailing 244,546 new vehicles in 2023.

Group 1 Automotive estimates it lost $17 million in pretax income in the second quarter because of the CDK outage.

That figure does not include an additional, one-time pretax payment of $5.9 million to compensate employees for lost wages.

CDK restored Group 1's DMS on June 26, just over a week after the outage began. Most dealers were down for about two weeks.

The early return of Group 1's DMS was in part because of the auto retailer's good relationship with CDK, CEO Daryl Kenningham said in a call with investors and analysts July 24. The technology in Group 1's customer contact center, digital retail options and back-office processes also helped the auto retailer recover quickly, he added.

The company didn't say anything directly about how CDK impacted sales.

Group 1, of Houston, Texas, ranks No. 4 on Automotive News' list of the top 150 dealership groups based in the U.S., retailing 175,566 new vehicles in 2023.

Lithia's same-store service and parts revenue fell 1.4 percent during the second quarter to $778.1 million, a decrease DeBoer said on the Aug. 1 earnings call was "primarily related to CDK, which drove aftersales down almost 40 percent during the 12 days of the outage."

He said Lithia still managed to keep most of the June service and parts business disrupted by the CDK outage scheduled within the second quarter. Some work was pushed into July, but would help boost that month's numbers, he said.

Nevertheless, DeBoer estimated "less than the majority" of Lithia's outage-related loss of $1.10 of earnings per share was recoverable — possibly as low as just 10 to 20 cents.

Lithia had a shot at keeping the service business, DeBoer said. For some consumers, the group might be the only option, particularly the 40 percent of Lithia stores in isolated markets, he said. But he said the auto sales Lithia lost during the outage were probably gone for good, captured by the retailers who don't use CDK.

"Customers don't typically wait around for 12 to 15 days to buy another car, " DeBoer said.

Lithia, of Medford, Ore., ranks No. 1 on Automotive News' list of the top 150 dealership groups based in the U.S., with retail sales of 314,116 new vehicles in 2023.

Penske Automotive's franchised dealerships in the U.S. and U.K. do not use CDK Global's dealer management system and were not impacted by the cyberattacks.

Penske Automotive's Premier Truck Group uses CDK's system, but quick action helped minimize the cyberattacks' temporary impact on truck customers, Rich Shearing, Penske's COO for North American operations, said during the company's July 31 earnings call.

"Our teams quickly implemented our incident response plan and alternative processes to keep operations open," Shearing said.

Penske Automotive, of Bloomfield Hills, Mich., ranks No. 3 on Automotive News' list of the top 150 dealership groups based in the U.S., retailing 229,942 new vehicles in 2023.

Sonic kept the cyberattacks from making a more significant impact, CEO David Smith said in a statement issued with the company's Aug. 5 earnings call.

"Overall, the Sonic Automotive team continues to execute at a high level, despite operational challenges in the last 12 days of the second quarter as a result of the previously announced CDK software outage," Smith said.

Sonic said operational disruptions continued through July, however, relating to functionality of some "CDK customer lead applications, inventory management applications and related third-party applications integration with CDK."

Sonic, of Charlotte, N.C., ranks No. 6 on Automotive News' list of the top 150 dealership groups based in the U.S., retailing 107,257 new vehicles in 2023.

— John Huetter, Paige Hodder, Gail Kachadourian Howe and Julie Walker contributed to this report.