ORLY · CIK 898173
What O'Reilly Automotive, Inc. told the SEC could break it.
Nearly everything O'Reilly flagged traces back to how concentrated and self-operated its business is: automotive aftermarket parts are its only material source of revenue, leaving the whole company tied to one product category and its end-market demand. The other disclosures sit downstream of that single line — a sales-mix shift toward lower-margin professional (do-it-for-me) work, and an operational reliance on its own distribution centers and company-owned delivery fleet to keep stores stocked. It rounds this out with the cyber and data-privacy exposure that comes from depending on third-party partners to maintain their own security programs.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Customer concentration
- single-product-line concentration — automotive aftermarket parts are the only material revenue sourcemedium
O'Reilly operates a single reportable segment (automotive aftermarket parts) across the U.S., Canada and Mexico, and product sales of automotive aftermarket parts are its only material source of revenue — concentrating the entire business in one product category and its end-market demand.
“Product sales of automotive aftermarket parts are the only material source of revenue for the Company.”
SEC filing →As of 2026
Cybersecurity
- reliance on third-party business partners/suppliers to maintain security programs (cyber + data-privacy)medium
O'Reilly relies on all third-party business partners to maintain appropriate security programs and cannot ensure their efforts will succeed; failure to comply with data collection/retention/processing/privacy and information-security laws by O'Reilly or its third-party service providers/suppliers could bring fines, sanctions, lawsuits, regulatory enforcement and reputational damage.
“We rely on all third-party business partners to maintain appropriate security programs; however, we cannot ensure in all circumstances that their efforts will be successful.”
SEC filing →As of 2026
Other disclosures
- gross-margin mix shift toward lower-margin professional (DIFM) saleslow
O'Reilly's gross margin is pressured by a sales-mix shift toward professional (do-it-for-me) sales, which carry a lower gross-margin percentage than DIY sales — partially offsetting gross-profit-dollar growth from comparable-store and new-store sales.
“which carry a lower gross margin percentage than DIY sales.”
SEC filing →As of 2026
Sole-source dependency
- distribution-network operational dependence — DCs (156k+ SKUs) and company-owned delivery fleet (5-night-a-week)low
O'Reilly's store-replenishment model depends on its distribution centers (stocking on average 156,000+ SKUs, most linked to multiple other DCs' inventory) and its Company-owned fleet providing five-night-a-week delivery plus multiple daily 'city counter' deliveries — a self-operated logistics network whose disruption would impair store service.
“Our DCs stock, on average, over 156,000 SKUs and most DCs are linked to and have access to multiple other DCs' inventory. Our DCs provide five-night-a-week delivery, primarily via a Company-owned fleet, to substantially all of our stores.”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch