Form 8K: https://www.sec.gov/Archives/edgar/data/1065696/000106569624000134/lkq-20241213.htm
On November 13, 2024, LKQ Corporation (the “Company” or “we”) detected unauthorized access to information technology (IT) systems of a single business unit in Canada (“Business Unit”). The attack disrupted the Business Unit’s operations.
Upon discovery, we immediately began taking steps to investigate, contain, and recover from the incident, including activating our security incident response and recovery plans, partnering with industry leading forensic investigators, and initiating containment measures for affected systems. We also promptly notified law enforcement authorities. We are analyzing data impacted by the incident and will be notifying affected parties as appropriate.
As a result of the incident, the Company’s operations within this Business Unit were adversely impacted for a few weeks while affected systems were recovered; however, the Company believes that it has effectively contained the threat and that none of its other businesses were impacted by the threat, and the Business Unit is now operating near full capacity.
As of the date of this filing, we believe the impacts of the cyber incident are not, and are not reasonably likely to be, material to our financial condition or results of operations for the fiscal year. We will be seeking reimbursement of costs, expenses, and losses stemming from the cyber incident by submitting claims to our cybersecurity insurers. The timing and amount of any such reimbursements is not known at this time.
