Public Statement from Arnold Clark Automobiles Limited
21st October 2026
We wanted to keep you informed of some recent developments relating to the cyber attack we suffered in December 2022, together with an update on the group legal proceedings currently progressing before the courts in Scotland and England.
As you are aware, in December 2022 we were the victim of a serious criminal cyber attack, which impacted some customers’ personal data. Sadly, cyber attacks are an increasingly common reality in today’s digital world, affecting organisations of all sizes across the private and public sectors. We strongly condemn the actions of criminals who seek to target organisations and individuals in this manner.
Our immediate priority following the attack was protecting our customers and containing the incident.
We shut down our affected IT systems, notified the relevant authorities, and engaged independent cyber security specialists to investigate and manage the incident.
As soon as we understood that personal data may have been affected, we acted immediately to notify potentially affected individuals and put the right tools directly into the hands of those potentially impacted.
Our aim was simple: to ensure that we equipped the people who may have been affected with the information and tools to protect themselves. Customers whose data may have been affected were offered complimentary identity and credit monitoring through Experian. This gave those individuals the practical means to watch for, and guard against, any attempted fraudulent use of their information.
At the time of the attack, we had substantial security measures in place, built on a multi-million pound investment in cyber security. We were then, and remain now, committed to protecting the personal data entrusted to us. Since the attack we have continued to strengthen our protections even further.
Following the attack, group litigation proceedings were issued in Scotland and England regarding the cyber incident. In the course of preparing our legal defence, our review of the facts and the available evidence - including the fact that our systems were breached during the attack - has led us to the difficult conclusion to concede breach of certain provisions of the UK GDPR. We will nevertheless continue to defend vigorously the remaining issues raised in those claims, including the allegations regarding the effects of the incident.
It is also worth noting that the attack took place almost four years ago. Following the steps we took at the time and since, we are not aware of any evidence that the affected personal data has been used to commit fraud or misused in any other way.
We continue to invest significantly in our cyber security, strengthening our defences and the measures that protect the personal data we hold. That work is ongoing, and it will not stop.
We remain genuinely grateful to our customers for their understanding and their continued trust. Protecting the information that is shared with us is a responsibility we do not take lightly. It is one we are committed to honouring every day.
These FAQs explain what happened in the December 2022 cyber attack, what Arnold Clark did in response, and what it means for you. If your question is not answered here, you can still get in touch using the contact details at the end.
No. This relates to the cyber attack we experienced back in December 2022. Our systems are not currently affected by that incident. The issue is being discussed again because of developments in the related group legal proceedings in Scotland and England.
No, our systems are not currently affected.
In December 2022, we were victim of a sophisticated criminal cyber attack, which impacted some customers' personal data. Cyber attacks are an increasingly common reality in today's digital world, affecting organisations of all sizes across the private and public sectors, including businesses, governments and individuals. We strongly condemn the actions of criminals who seek to target organisations and individuals in this manner.
When our cyber security controls identified the attack, we took immediate action to protect our systems and our customers. This included shutting down our IT systems, notifying the relevant regulatory and law enforcement authorities, and engaging leading independent cyber security specialists to investigate and manage the incident.
Our overriding priority was the protection and reassurance of our customers. We contacted customers who may have been affected and provided guidance on steps they could take to help protect their personal information. We made credit and web monitoring services available through Experian at the time, providing customers with a practical way to monitor for any potential misuse of their information.
Customers can take reassurance from the fact that the attack took place almost four years ago, and since then, there is no evidence of any fraud or use of affected data. Further, we understand from our technical advisors that this data is not currently available on the dark web.
At the time, we offered all customers Experian credit and web monitoring services as further practical means to watch for and guard against any attempted misuse of any information.
No. Receiving a notification letter does not confirm that personal data was affected. The letters were sent as a precaution to customers who may have been affected.
The attack took place almost four years ago. Following the steps we took at the time and since, we are not aware of any evidence that the affected personal data has been used to commit fraud or misused in any other way.
No. A breach of data protection obligations does not, in itself, mean that compensation is payable to an individual. A claimant must show that they have suffered damage that meets the required legal threshold, which we do not accept has been established.
In the immediate aftermath of the incident, we partnered with Experian to offer affected customers complimentary access to specialist tools, support and credit and web monitoring services, at no cost, for a period of two years. Given the length of time that has passed since the incident, we are no longer offering this service.
We remain firmly committed to maintaining and strengthening our cyber security framework in line with evolving threats and technological developments. Protecting our customers' information continues to be a priority, and we will continue to invest in robust security measures.
If your question is not answered above, please contact us at customerservice@arnoldclark.com.