ARNOLD Clark has suffered a major ransomware attack in which large volumes of sensitive customer data were stolen.

Among the data were stolen bank details, passport copies, driver’s licences, vehicle information, and National Insurance numbers, with other information likely targeted in the attack, claimed by Play ransomware gang.

The UK-wide breach occurred on December 23 with customers emailed about the incident on Tuesday.

Cybersecurity expert Achi Lewis, Area VP EMEA for Absolute Software, said: “Uncertain economic times and the lead-up to a holiday make the perfect storm for cyber-attackers, often creating a more relaxed and weakened security posture to be exploited. Ransomware attacks don’t discriminate against any sector, with the automotive industry home to vast volumes of sensitive data, demanding both preventative and reactive cybersecurity measures to be put in place by organisations.

“Companies across all industries should take this opportunity to evaluate their current cyber posture, implementing measures such as resilient Zero Trust to prevent threat actors from breaching devices, applications and networks.

Resilient Zero Trust is a security model that authenticates users on a case-by-case basis, only allowing access to devices and applications if there are no signs of suspicious activity. If unusual behaviour is detected, access can be frozen or shut off by a centralised IT team to prevent a breach.”

“Ransomware attacks are a case of when, not if, so it is imperative that organisations focus on their response protocols as well as prevention. Leveraging self-healing solutions can help to recover and repair devices that have been breached, protecting them from future attacks. A full recovery can take months or even years from the initial investigation, so ensuring high cyber preparedness is vital.”

Arnold Clark owns nearly 200 dealerships across Scotland and England, selling more than 300,000 cars each year.