Ex-Arnold Clark boss calls for action over cyber attacks

A 2022 cyberattack had a “significant and long-lasting” impact on one of Scotland’s biggest companies, its former CEO has said.

Customer data was stolen from the Glasgow-based car dealer in an incident which caused £50m worth of disruption to the firm.

The company shut down its entire computer system as a result of the attack and profits fell in the aftermath as mitigations took place.

Eddie Hawthorne, former chief executive of Arnold Clark, has called for more action to protect against hackers.

Hawthorne took part in a Scottish Parliament event organised by the Cyber and Fraud Centre – Scotland which covered cybercrime.

He said: “Experiencing a major cyberattack first-hand showed me how significant and long-lasting the impact can be.

“We need to ensure businesses have the right support when an attack happens and address the gaps that allow criminals to continue exploiting stolen data afterwards.”

The event was hosted by Calum Kerr MSP, who previously worked for IT firms. Kerr said: “Cybercrime affects individuals, businesses and public services across Scotland. After a near 30-year career in IT and technology I've seen this firsthand and I'm keen to take the issue forward.

“While much of the relevant legislation sits at Westminster, there is much we can and should do in Scotland to strengthen resilience, support victims and make it harder for criminals to profit from stolen data. This discussion demonstrated why we need continued collaboration between government, law enforcement, industry and cyber experts to better protect victims and strengthen Scotland’s resilience.”

Jude McCorry, CEO of the Cyber and Fraud Centre - Scotland, said: “Cyberattacks don’t end when systems are restored. Stolen data can continue to be traded and exploited, causing further harm to people and businesses.

“The Cyber and Fraud Centre - Scotland will continue working with politicians, businesses and public bodies in Scotland and across the UK to push for stronger protection for victims and action to address the criminal exploitation of stolen data.”