2 days ago
Arnold Clark has said it will not face any ‘formal action’ from authorities following its cyber attack – but the effects of the incursion has seriously dented its earnings.
Arnold Clark saw pre-tax profit fall nearly 33% in 2023 to £116m, despite revenues rising to just shy of £5bn.
The firm said fewer cars were sold at the start of the year following the incursion into its systems by hackers over Christmas 2022.
In its annual report, the car dealer giant said the Information Commissioner’s Office (ICO) confirmed earlier this year that the dealer group would not face any formal action after criminals stole customer details and crippled the business.
Showrooms were forced back to pen and paper in early 2023 after the attack rendered many systems inoperable. Some systems were not fully restored for six months, seriously impacting the group’s performance.
New and used car sales were down in 2023 as a result. The number of used cars sold totalled 187,735, down 2.7% on the year before, while new car sales fell 5%, to 53,004.
CEO Eddie Hawthorne said: ‘The group has been, and continues to be, in continual communication with the police, security agencies and the regulatory authorities, as this is a crime which inflicts significant damage on businesses and society and the criminals need to be stopped.
‘In late December 2022 the group was subject to a cyber-attack by an unauthorised third party.
‘We, and over 150 other companies, were targeted by this third party over the Christmas period, at a time when the attackers expected the response to be minimal.
‘Our external security network consultants alerted us to the unusual activity on our network and our cyber security team were available and able to immediately respond to the attack, defending ourselves and ultimately taking steps to minimise the impact of the attack by removing all external connections to our network.’
Hawthorne said the main aim of the attack was to ‘lock us out of our systems’ and ‘hold the company to ransom’.
He added: ‘By disconnecting our systems, the threat actors failed in this objective but during the attack they were able to steal copies of some data that we hold.
‘Where we believed that personal data may have been stolen, we have contacted impacted parties on a timely basis and offered guidance and protection in conjunction with our partners at Experian.’
The car dealer group says it has now taken a series of steps to mitigate these issues happening again.
These include appointing a new chief information security officer, testing IT contingency plans and investing in ‘robust IT systems’. The firm says it is also ‘continually reviewing cyber security protocols’ and ‘business continuity’.
Hawthorne added: ‘This attack consumed a significant amount of resources and senior management time to resolve and our digital team did a tremendous job rebuilding our networks and reinstating our systems to full operational functionality.
‘This full functionality was not achieved until July, which meant our performance, particularly in the first quarter of 2023, was significantly impacted by this incident.’
The company’s annual report shows it raked in £4.96bn in 2023, up just 0.9% on the year before.
Shareholder funds rose by nearly 5% to £1.5bn. The company owns £469m of freehold property, £100m of investment properties and £363m of net funds.
Revenues from Arnold Clark’s finance arm rose by 23% to £537m. That part of the business contributed £40m profit before tax to the group.
An interim dividend of £15m was paid during the year and directors did not recommend a final dividend to be paid. The highest paid director received emoluments of £4.3m.
Hawthorne added: ‘The year-ended 31 December 2023 saw the group face several significant challenges, starting with the impact of a cyber-attack, combined with ongoing vehicle supply constraints, the impact of inflation on consumer demand and the effect of higher interest rates.
‘Despite these challenges, I am pleased to report that the group has delivered a profit before tax of £116m, demonstrating the resilience and financial strength of the group.
‘Our used vehicle sales dropped by 3% which was in part due to our slower start to the year as a result of the cyber-attack, a lack of availability of vehicles up to three years old and reduced demand towards the end of 2023 as the increased cost of living started to affect our customers.
‘Despite these challenges, our average vehicle margins were healthy and in line with 2022.’
Arnold Clark’s aftersales revenue increased 5% to £212m during the year.
Looking ahead, Hawthorne said he was pleased to have added Chinese brands to the group’s portfolio, including BYD, Genesis, GWM Ora, Omoda and Jaecoo. He believes this will have a ‘positive’ impact on the current year.
Hawthorne said the group was also investing in properties with £19m spent on sites in Chertsey, Dartford and Northampton in 2023, with a further £3m spent in 2024 on a showroom in Ayr.
He added: ‘Despite the reduction in profits in the current year, I am cautiously optimistic about 2024.
‘There remains continued uncertainty in the motor industry, but I expect vehicle supply constraints to continue to improve in 2024, which will complement our high order banks for both our retail sites and our Contract Hire business.
‘With strong levels of funding, we remain well placed to capitalise on the opportunities that the challenging conditions bring.’
- Car Dealer Live 2025: Book tickets now
- Weekly Briefing: Read our editor’s take on the news
- Join our breaking news WhatsApp group
- Sign up for daily email Car Dealer news bulletins
- Listen to the latest Car Dealer Podcast
- Read the latest digital issue of Car Dealer Magazine
The post Cyber attack dents Arnold Clark’s profits but group will face ‘no further action’ appeared first on Car Dealer Magazine.
