Arnold Clark has conceded that it breached parts of UK data protection law in connection with the cyber attack on its computer systems in December 2022.
The AM100 dealer group made the concession as it prepares to defend group litigation progressing through courts in both Scotland and England.
Read: One click from crisis: What blinds us to how cyberattacks really start
Arnold Clark said its review of the facts and available evidence had led it to concede breaches of certain provisions of the UK General Data Protection Regulation.
However, the company continues to dispute allegations concerning the effects of the incident and whether individual claimants suffered harm meeting the legal threshold for compensation.
Thousands included in action
The Scottish proceedings follow an April 2026 Court of Session decision permitting Robert Adamson to bring a group action on behalf of around 15,000 Arnold Clark customers.
Claimants allege they suffered loss or damage after personal information was released following the attack. The group proceedings do not establish that every member suffered compensable harm or determine how much compensation might be payable.
Glasgow law firm Jones Whyte, which represents more than 3,000 people in the Scottish proceedings, described Arnold Clark’s concession as a significant development.
Dominic Ritchie, Jones Whyte partner and head of group actions, told the Glasgow Times: “This is a significant development for the thousands of people affected by the Arnold Clark cyber attack.
“Arnold Clark has now formally admitted that it breached data protection law and, crucially, that the cyber attack would not have happened but for those failures. For almost four years, those affected have been seeking accountability following the compromise of their personal information.
“This admission represents an important step forward in securing that accountability.”
Dealer group disputes harm
The attack took place on December 23, 2022, prompting Arnold Clark to shut down affected IT systems, contact the relevant authorities and appoint independent cyber security specialists.
The dealer group contacted customers whose information may have been affected and offered two years of identity and credit monitoring through Experian.
In a statement on it website, Arnold Clark said it was not aware of evidence that affected personal information had been used to commit fraud or misused in another way. It added that its systems were no longer affected by the incident.
The company said it had substantial security measures in place at the time of the attack and had continued to strengthen its cyber defences since the incident.
Arnold Clark’s concession does not settle the litigation. Individual claimants must still establish that the breach caused harm meeting the required legal threshold, an issue the dealer group said it would continue to defend.
Ensure you always receive AM insights. Make us a preferred source of news on Google