16th February 2023
Arnold Clark takes the protection of our customer data extremely seriously, therefore, we have now taken the decision to proactively contact customers who may have been affected to make them aware of the cyber incident, and to offer them guidance and protection in conjunction with our partners Experian.
We are working to protect our customers as a matter of priority, and we will continue this process to ensure all our customers who may have been affected by this incident are made aware and are offered assistance and protection.
Arnold Clark remains in regular contact with the regulatory authorities and is continuing to seek guidance from the police.
9th February 2023
We are continuing to work with our external advisors to identify the full scope of the data affected by the cyber incident, both from evidence available on our systems, and from information obtained from these advisors.
If any of this data relates to you a separate communication will be sent out to you directly.
We have now completed the set-up of a helpline with Experian, and have notified those customers who we have identified to date as potentially being impacted.
As you will appreciate, we are unable to provide a definite timescale for completing our investigation at the moment, as this is such a highly complex exercise. We will, however, continue to keep you regularly updated.
We thank you for your patience and co-operation.
If you need to contact us about this incident, you can do so by contacting customerservice@arnoldclark.com.
28th January 2023
On the evening of 23 December 2022, Arnold Clark Automobiles was a victim of a cyber attack. Our external security network consultants alerted us to unusual activity on our network, and we immediately took steps to minimize the impact of the attack by removing all external connections to our network to protect our customer data, third-party partners and our systems.
While we were initially advised that all our data was secure, unfortunately, in the course of our investigation, it has become clear that during this incident, the attackers were able to steal copies of some data that we hold. Due to the type of cyber attack that we have been subjected to, it is extremely difficult to accurately identify what has been stolen; however, our teams are working with our external advisors to understand the exact nature and extent of that data.
While this crime and theft of data has been targeted towards Arnold Clark, we recognise the impact this could have on our partners and customers. We take their safety and the safety of their data very seriously, therefore while further analysis is ongoing, we are taking the following steps now:
During this incident we have been in constant communication with the regulatory authorities and have sought useful guidance from the police, and we will continue to do so to help other companies learn from our experience and be better prepared for possible situations such as this.
As a result of this incident, we have taken the decision to rebuild our networks in a new segregated environment, which has meant that our operational systems are not yet fully functional, so we apologise for any inconvenience this may cause our customers.
If you need to contact us about this incident, you can do so by contacting customerservice@arnoldclark.com.