Cybercriminals hacked the personal details of Arnold Clark customers.
KP Law can help victims to claim compensation.
In December 2022, cybercriminals reportedly gained access to national car retailer Arnold Clarke’s IT systems and exfiltrated hundreds of gigabytes of consumer data belonging to tens of thousands of customers.
The cybercriminals, the Play ransomware cartel, then demanded a multi-million-pound ransom and threatened to upload the information of tens of thousands of customers to the dark web if they were not paid.
According to various media reports, the stolen data includes:
The cybercriminals released an initial 15 gigabytes of sensitive data on 17 January 2023. A further 30 gigabytes of data was posted on the dark web on 14 February 2023, and on 31 March 2023, another 475 gigabytes of data was discovered on the dark web.
KP Law has launched an investigation and group action to find out what happened and how this breach affects Arnold Clark customers. We believe that failures to adopt standard security measures may have made this attack easier.
Our data breach group action will help affected customers in England & Wales claim compensation for the security failures. We currently represent in excess of 7,500 customers and are helping them to seek information and redress.
“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
Arnold Clark experienced a cyber security incident on 23rd December 2022. It was issued with a multimillion-pound ransom demand from the Play ransomware cartel. A 15GB tranche of stolen customer data was allegedly shared on the dark web, with another, much larger upload threatened if the cryptocurrency ransom was not paid.
The cybercriminals then carried out their threat and released another 30 gigabytes of data on the dark web.
The list of potentially compromised data includes customer:
On 3 January 2023, 11 days after the cyberattack, Arnold Clark said:
“Late on the evening of 23rd December, the Group was notified by our external cyber security consultants of suspicious traffic on our network. Once we confirmed this internally with our own Cyber team, we made the decision to bring down our network voluntarily as a purely protective measure, which has resulted in us cutting connectivity to the internet, our dealerships and our third-party connections.
“Our priority has been to protect our customers’ data, our systems and our third-party partners. While this has been achieved, this action has caused temporary disruption to our business and unfortunately our customers.
“Our external security partners have now been performing an extensive review of our whole IT network and infrastructure, which is a mammoth task, and they are providing guidance to our IT team on the re-enabling of our network and systems in a safe, secure and phased manner.
“Our showrooms and branches are open and will be able to assist our customers using our temporary systems until we have been able to restore our full systems safely. We expect to resume customer vehicle collections later this week and our branches are contacting customers to arrange this.
“Once again, we would like to thank our customers for their understanding and to apologise for any inconvenience this has caused.”
On 28 January 2023, Arnold Clark released a further statement about the attack. In this, the company appeared to admit that, while its IT systems were capable of being set up so that they were not vulnerable to external attacks (a segregated environment), work to achieve this had only just begun.
The volume of data at risk leads us to believe that any customer of Arnold Clark in the last ten years has a high probability of their information being accessed.
Arnold Clark is writing to all affected and potentially affected customers and will continue that communication as its investigation progresses.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you live in England or Wales and you are involved in this breach, you may be able to join our no-win, no-fee compensation claim. There are no costs to register and no obligation to proceed.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
Arnold Clark customers had their personal information compromised after hackers broke into the car dealer’s systems. Tens of thousands of people are thought to be at risk. According to reports, the stolen data includes: Bank account and sort code details may also have also been stolen. At KP Law, we
Associate Bill Singer has commented on the ongoing Arnold Clark data breach claim and the fraud risks to those impacted in Computer Weekly. Bill’s comments were published in Computer Weekly, 13 June 2023, and can be read here. Bill said that frauds linked to the Arnold Clark breach are appearing all
Associate solicitor in our Data Breach team, Bill Singer, has commented in Car Dealer Magazine detailing the extent and severity of Arnold Clark customer data which has been exposed on the dark web.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
