AutoCanada discloses cyberattack impacting internal IT systems

Hackers targeted AutoCanada in a cyberattack last Sunday that impacted the automobile dealership group's internal IT systems, which may lead to disruptions.

The company says that it took action immediately after detecting the incident to protect its network and data. External cybersecurity experts have been contracted to help with containment and remediation efforts.

The investigation has yet to determine if any data has been compromised during the incident.

“As the investigation is ongoing, the full scope, nature and impact of the incident, including the extent to which any customer, supplier or employee data has been accessed is not yet known,” AutoCanada says.

The company says that although "business operations remain open at this time, the incident may result in disruptions until the relevant systems are fully restored.”

AutoCanada is a large car dealership operator that employs over 4,700 people. It operates 66 franchised dealerships in Canada covering 25 car brands and another 18 franchises in the United States that 16 car brands.

Last year, the company generated over $6 billion in revenue, and sold over 100,000 vehicles via its retail stores.

BleepingComputer has contacted AutoCanada to learn more about the nature of the incident but we have not heard back at the time of publishing.

At the time of writing, no major ransomware groups claimed the attack on AutoCanada.

It’s worth noting that AutoCanada has also been impacted by CDK Global's massive IT outage caused by the BlackSuit ransomware attack.

Along with disclosing the cyberattack yesterday, the company also published its second quarter financial results, saying that "several headwinds during the second quarter, which substantially affected our performance."

In numbers, AutoCanada recorded losses of $33.1 million in Q2 2024, whereas in the same quarter last year, it had a profit of $45.2 million.

The company noted that the CDK outage started on June 19 and lasted until July 1, but the recovery, validation, and cleanup process on the impacted systems was not completed until the end of that month.