Glasgow car dealer Arnold Clark admits failures led to cyber attack

Arnold Clark has admitted that its failure to protect customer data led to a 2022 cyber attack.

The car dealer accepted the position in a formal document lodged at the Court of Session .

Arnold Clark has admitted a failure to keep customer information secure, which breached data protection law. They also accepted the December 2022 attack would not have happened but for that failure.

Arnold Clark accepted it is, in principle, liable to compensate members of a group action who can prove they suffered harm.

Judge approves for 15,000 motorists to pursue Arnold Clark after dark web data breach

Judge approves for 15,000 motorists to pursue Arnold Clark after dark web data breach

1000 Scots to join legal action against Marks and Spencer after cyber attack

1000 Scots to join legal action against Marks and Spencer after cyber attack

Glasgow Arnold Clark customers warned after hackers steal personal data

Glasgow Arnold Clark customers warned after hackers steal personal data

M&S faces multi-million pound lawsuit by Scots over huge data leak

M&S faces multi-million pound lawsuit by Scots over huge data leak

However, individual claims have not yet been decided. Questions whether the data breach caused an individual's loss, and how much compensation may be due, are still to be considered.

Arnold Clark has reserved its position on those issues.

The group action is being brought under Chapter 26A of the Rules of the Court of Session. The case is Robert Adamson v Arnold Clark Automobiles Limited , with reference GP9-26.

Glasgow law firm Jones Whyte represents more than 3,000 people involved in the Scottish proceedings and is part of the claimant steering group. It said the number of people involved could increase because new clients may still be able to join.

Jones Whyte said people who were Arnold Clark customers before December 2022 and believe their information was affected should the firm as soon as possible as time limits apply.

Dominic Ritchie, Jones Whyte partner and head of group actions, said: "This is a significant development for the thousands of people affected by the Arnold Clark cyber attack.

"Arnold Clark has now formally admitted that it breached data protection law and, crucially, that the cyber attack would not have happened but for those failures.

"For almost four years, those affected have been seeking accountability following the compromise of their personal information."

"This admission represents an important step forward in securing that accountability."

The attack took place on the evening of December 23, 2022. Arnold Clark shut down its computer network on Christmas Eve while investigations began.

Customers were contacted in January and February 2023 after the company found that attackers had extracted personal data.

Information believed to have been taken included names, addresses, dates of birth, vehicle details, information, National Insurance numbers, passport and driving licence copies, and banking details.

TalkTalk website hit by "significant cyber attack"

TalkTalk website hit by "significant cyber attack"

TalkTalk fined a record £400,000 over cyber attack on customer data

TalkTalk fined a record £400,000 over cyber attack on customer data

Yahoo: 'Hackers stole data from 1bn users'

Yahoo: 'Hackers stole data from 1bn users'

Customers warned as hackers target Carphone Warehouse data

Customers warned as hackers target Carphone Warehouse data

In some cases, customers were told unsigned copies of finance agreements dated 2019 and earlier may have been stolen. Arnold Clark warned that affected people could face fraud and phishing attempts.

The company offered a two-year Experian service to monitor suspicious activity and advised customers to check bank statements and credit reports. It also advised them to use strong passwords and avoid giving personal information to unknown callers.

Court permission for the Scottish group proceedings was previously granted by Lord Sandison. Around 15,000 motorists were understood to have been eligible to pursue the claim.

Arnold Clark had argued that a similar case in England made that court a more suitable place for Scottish customers. Lord Sandison rejected that argument, noting that more than 95 per cent of proposed group members lived in Scotland and had contracted with a Scottish company under Scots law .

Separate proceedings connected with the attack are continuing in England. Arnold Clark’s legal representatives have indicated a similar position there, according to Jones Whyte.

The latest admission does not settle the claims or set compensation. Each claimant must still establish that they suffered harm caused by the breach.