AP Eagers Limited

Summary

Eagers Automotive experienced a cyberattack that disrupted IT systems at some locations in Australia and New Zealand and compromised personal information of a small number of customers. The attack, claimed by LockBit 3.0, hindered the company’s ability to finalize transactions for certain vehicles and prompted a trading halt on the Australian Securities Exchange while external experts investigated and the firm notified Australian and New Zealand cybersecurity centers.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 27 December 2023 Eagers Automotive Limited entered a trading halt on the Australian Securities Exchange after becoming aware of a cyber incident affecting its IT systems. The company announced the incident on 28 December, stating that the outage was impacting systems in some operating locations across Australia and New Zealand while the full extent could not yet be ascertained. Eagers apologised to customers for any inconvenience and appointed external experts to support an urgent investigation, emphasizing that the security and privacy of customer and employee data remained its highest priority. The Australian Cyber Security Centre and the New Zealand National Cyber Security Centre were notified, and the company indicated it would remain in trading halt pending a further ASX announcement.

In subsequent updates Eagers said the disruption primarily affected its ability to finalize transactions for certain new vehicles that had been sold and were ready for delivery, as well as some service and parts operations, with the operational impact varying across regions and business units. The company noted that financial losses might be limited to transactions that could not be completed in the last five days of December and that an ASX filing described the incident as involving unauthorized access to parts of its IT systems by a third party that accessed some data from its servers. Eagers stated it was notifying a small number of individuals whose data had been accessed, although it did not disclose the total number affected, and that further updates would be provided as the investigation progressed. The LockBit 3.0 ransomware group claimed responsibility, posting a screenshot on its data leak site on 30 December that listed Eagers as a victim and gave a deadline of 19 January for a ransom payment, to which Eagers did not respond publicly.

Prior to the attack Eagers had announced in October an upgrade of its cybersecurity capabilities using Check Point CloudGuard to improve visibility and manage multi-cloud assets, and in early December it had deployed SentinelOne to enhance threat detection across connected devices. A spokesman reported in The Australian that the company was investigating rapidly and, to that point, had found no access to or misuse of customer or employee information, while external incident response experts continued to support the investigation and restoration efforts. The intrusion occurred amid broader warnings that car retailers are attractive targets for cybercriminals, with the Australian Automotive Dealer Association sponsoring workshops on dealership IT security and industry leaders noting that such attacks often lead to ransom demands and can cause significant financial and operational harm. The Australian government’s recent AU$587 million cyber strategy was referenced as contextual background, and a survey of Australian CEOs cited cyber attack as the single biggest external threat to business operations.

Sources

Sources available to members: 3 sources.