Arnold Clark is facing hundreds of compensation claims after admitting liability over a major cyberattack in which customer personal details were stolen and published on the dark web. The Glasgow-based motor group has conceded that failures to comply with UK data protection laws allowed hackers to breach its computer systems in 2022, exposing sensitive customer records including personal and financial details.
In a significant development in the group legal action, which involves more than 15,000 claimants, the firm admitted the cyberattack would not have happened “but for those failures”. The admission shifts the focus of the case to the harm suffered by customers, including distress, anxiety and the risk of fraud after their information was exposed.
Legal Progress and Customer Impact
Amy Haughton, of Thompsons Solicitors, said: “Arnold Clark has admitted liability. That is now out of the way because the admission is in court. It is just down to what harm was suffered by the big group members. So, the good news is we’re moving forward more quickly than we’d have anticipated.”
She added: “The bad news is Arnold Clark is still dragging its heels by taking the position that its customers couldn’t possibly have experienced any distress. The general common theme from people we have spoken to is concern about losing control of their data and who might have accessed it. And then we have some clients who have advised us that following the breach, they noticed an increase in spam calls.”
Customer Accounts of Distress
Barry, from Lanarkshire, who is being represented by Thompsons Scotland, said: “Not long after the data breach, several of my accounts which used the same email address were hacked and I received threatening scam emails. Later, I also received letters from a bank stating that someone had tried to apply for a credit card and a savings account in my name. This is very distressing and I have ongoing concerns about my data being out there and what it could be used for. Arnold Clark has not taken any accountability for what has happened, and they do not understand the severity of the breach.”
Cameron, also from Lanarkshire, added: “I was really concerned when I received the email from Arnold Clark about the data breach. I am aware how much can be done with even limited personal and banking information. I have noticed an increase in spam emails since the data breach and I immediately changed my online banking login details. I have ongoing concerns and contemplated changing my bank account but I do not feel this a step I should need to go through when it is the fault of Arnold Clark that my personal data was not kept safe.”
Court Ruling and Financial Estimates
Arnold Clark had previously argued the case could not be pursued in a Scots court. However, the Court of Session ruled in April that claims can proceed in Scotland because the vehicles were sold north of the border. The judge found the situation has no connection with England for Scottish claimants.
Experts estimate the bill for UK claims may top £100 million, and the firm is already thought to have lost £300 million in potential profits. Arnold Clark did not respond to a request for comment.
