Automotive Holdings Group

Summary

Eagers Automotive, an Australian automotive dealership group operating across Australia and New Zealand, experienced a cyber incident that disrupted IT systems at some locations and forced a trading halt of its shares. The attack restricted the company's ability to finalize transactions for certain new vehicles ready for delivery and affected some service and parts operations, while most dealerships continued operating. Unauthorized access to parts of its IT systems allowed a third party to access some server data, leading to notifications to a small number of affected individuals, though the total number was not disclosed. The company engaged external cybersecurity experts and notified national cybersecurity authorities in both countries, and a ransomware group claimed responsibility for the intrusion.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 27 December 2023, Eagers Automotive Limited became aware of a cyber incident and entered a trading halt on the Australian Securities Exchange to manage its continuous disclosure obligations. The company announced the incident publicly on 28 December 2023. The outage affected IT systems in some operating locations across Australia and New Zealand, while a majority of dealerships continued to operate. The disruption restricted the company's ability to trade within certain parts of its business in some operating locations in both countries. It primarily impacted the ability to finalize transactions for certain new vehicles that had been sold and were ready for delivery, as well as some aspects of service and parts operations. The extent of operational impact varied across regions and business units. The full extent of the cyber incident could not be ascertained at the time of the initial announcement. The company warned customers, suppliers, and other business associates to remain alert to suspicious or untoward activities in IT interactions with Eagers. External incident response experts were appointed to support the investigation and response. The company notified the Australian Cyber Security Centre and the New Zealand National Cyber Security Centre.

On 28 December, the company stated that financial losses might be limited to some transactions that could not be completed in the last five days of December. In a subsequent ASX filing, the company disclosed that the incident involved unauthorized access to parts of its IT systems by a third party, which accessed some data from its servers. The company began notifying a small number of individuals whose data was accessed, though it did not state how many individuals were affected. The LockBit 3.0 ransomware group claimed responsibility for targeting Eagers' network. According to a screenshot posted by cybersecurity analyst Dominic Alvieri on X, the ransomware group listed the automotive retailer as a victim on its data leak site on 30 December and gave the company a deadline of 19 January to pay a ransom. Prior to the attack, in October, Eagers had announced it would upgrade its cybersecurity capabilities using software from Check Point Software Technologies, adopting Check Point CloudGuard for improved visibility into its cloud environment and automating governance across multi-cloud assets. In early December, the company announced it was using SentinelOne to enhance its cybersecurity posture with a targeted view of threats across connected devices. The intrusion occurred after these security announcements. The company said it had not found any access to or misuse of customer or employee information as of the initial statement, but later confirmed unauthorized access and data access. The incident took place shortly after the Australian government unveiled an AU$587 million cyber strategy.

Eagers engaged external cybersecurity experts to investigate the incident. The company remained in trading halt and intended to issue further ASX announcements in compliance with Listing Rule 3.1. It stated that the security and privacy of customer and employee data was its highest priority. All efforts of the business were focused on safely restoring systems. Customers were told they did not need to do anything but were asked to remain vigilant of suspicious activity. As the investigation progressed, further updates would be provided to customers, employees, shareholders, regulators, and other stakeholders. Eagers did not respond to Information Security Media Group's questions about the attack by the time of publication. The attack came after Nissan Oceania suffered a cyber incident in December that affected some dealer systems and possibly compromised customers' personal information.

Sources

Sources available to members: 3 sources.