Auto parts company LKQ attacked by hackers, Canadian office down for weeks

American car parts company LKQ has disclosed that one of its business units in Canada was hacked and disrupted its day-to-day operations.

LKQ engages in the distribution of replacement parts, components, and systems used in the repair and maintenance of vehicles and specialty vehicle aftermarket products and accessories. The company distributes bumper covers, automotive body panels, and lights, as well as mechanical automotive parts and accessories. LKQ employs over 49,000 employees and was able to generate over $13.8 billion in revenue in 2023.

In an 8-K Filing addressed to the Securities and Exchange Commission (SEC), the company writes it detected ‘unauthorized access’ to some of its IT systems of a single business unit in Canada on November 13.

“Upon discovery, we immediately began taking steps to investigate, contain, and recover from the incident, including activating our security incident response and recovery plans, partnering with industry leading forensic investigators, and initiating containment measures for affected systems,” LKQ states. Law enforcement authorities were also informed about the incident.

LKQ is currently analyzing the data that is impacted by the attack. Victims that are affected by the incident will be kept in the loop.

The cyberattack disrupted the business unit’s operations for a few weeks. The company took this time to recover its affected systems. Through this course of action the company believes that the threat is neutralized. The Canadian business unit is now operating at near full capacity.

The company doesn’t think the incident will have a material impact on the company’s financial condition or operational results. “We will be seeking reimbursement of costs, expenses, and losses stemming from the cyber incident by submitting claims to our cybersecurity insurers. The timing and amount of any such reimbursements is not known at this time,” it says.

As of writing, no ransomware group has claimed responsibility for the attack.