Ransomware Recovery Lessons Learned From Arnold Clark

As with playing the piano, getting to Carnegie Hall and combating ransomware, there’s only one real path to mastery.

See Also: Top 10 Technical Predictions for 2025

“Practice, practice, practice,” Eddie Hawthorne, chief executive and group managing director of Arnold Clark, told a Scottish cybersecurity conference on Tuesday.

Glasgow-based Arnold Clark, Britain’s largest independently owned car retailer and one of the largest car dealer groups in Europe, employs over 10,000 people and sells over 300,000 cars annually across more than 200 U.K. retail locations.

All of that got thrown into disarray on Dec. 23, 2023, when ransomware-wielding attackers came calling (see: Ransomware Gang Stole Customer Data, Arnold Clark Confirms).

Speaking at the seventh annual Cyber Security conference hosted by Futurescot at Glasgow’s Strathclyde University, Hawthorne said that with an IT staff numbering 220 people, he thought his firm was well-prepared to see off whatever cyberthreats it might face.

“Did I get a shock,” said Hawthorne, who, after 27 years at the helm of Arnold Clark, is due to step down next month.

In the end, the attack cost his firm nearly 50 million pounds – about $63 million – and led to months of recovery efforts as the company slowly brought networks and systems back online, prioritizing the most important parts of the business first.

One of the big takeaways from the attack, he said, is to always live the mentality that “cybersecurity is a journey,” meaning it’s a never-ending process of organizational self-improvement, with cyber resilience being one of the key focal points.

For countering whatever future threats the organization faces, “speed of response is the best defense,” he said. At the time of the attack, Arnold Clark’s average incident response time was about 12 to 18 hours. Now, he said the organization has driven that down to just one or two hours.

One complicating factor for maintaining high levels of readiness is that as time progresses, the attack recedes in the minds of employees – never mind the influx of new employees who didn’t live through it when IT pulled seemingly nonstop shifts and risked personal burnout to get the organization back on its feet.

“The biggest threat I see is complacency,” he said.

In the wake of the breach, Arnold Clark has devoted greater attention to its supply chain, not least given many ransomware groups’ focus on exploiting small parts of supply chains to cause greater disruption, to make more money.

As an automotive retailer, the organization works with numerous suppliers and has been reviewing these business partners’ security posture and articulating the levels of assurance it needs to see. In one case, Hawthorne said, the company is having to cease a 20-year working relationship with a supplier because the organization hasn’t been able to demonstrate that it’s taking steps to stay secure.

How the Attack Unfolded

For Arnold Clark, Hawthorne said the first sign of trouble arrived about 6:30 p.m. on the Saturday that the attack occurred, two days before Christmas. “‘Boss, I think we’ve got a problem here. I think there’s some unusual activity happening on our network,'” and that was the deletion of files, or the attempted deletion of files, and that was the first communication,” Hawthrone said.

In retrospect, the organization was lucky the attack happened when it did – even on a weekend – when there were relatively more people at work still before the holiday began.

“At midnight, the fun began. It was a big game of giant whack-a-mole, man versus machine.” Less than three hours later, “we were losing control of our systems, we were about to be locked out, and then we took the brave decision to pull the plug, which was the only option that I had. Now, being an old dinosaur, I would have pulled the plug about four hours before, but that’s just me; we were trying to defend ourselves.”

When the ransomware deployed, it infected 5% to 10% of the company’s servers, then stopped.

On Dec. 24, the response team reconvened, and Hawthorne said his expectation was that they could simply restore from the organization’s copious, intact backups and mirrored systems and resume business. “But I don’t have another network, or active domain controllers,” which are Windows servers that authenticate users and devices for an Active Directory domain. “Even if I did, the security people were telling me, don’t plug it in because you don’t know what’s there.”

This was their reality: “no phones, no systems, no emails, no access to systems, no list of people who you would actually phone because it’s all on your computer and you can’t get access to it.”

Arnold Clark faced 700 customers coming in just after the holiday to pick up a car and had “no idea who they were,” he said. Same for 2,000 people scheduled to bring in their car for service and 1,500 who were due to return a rental car.

The company began working with Police Scotland and other agencies. As it worked to recover systems – safe in the knowledge it had fully working backups – Hawthorne said he chose to not pay any ransom but did engage in negotiations with attackers to try and identify what data they might have stolen, so the company could warn customers. Investigators concluded the attackers never penetrated the company’s data center, but they did obtain some unstructured data from head office systems.

“I thought it was encrypted,” Hawthorne said, which was true, except only for data at rest. Attackers appeared to have successfully intercepted data in transit, and, in mid-January 2024, threatened Arnold Clark that they would dump the data unless they received a ransom. Again, the company declined.

As the Glasgow cybersecurity conference on Tuesday, Hawthorne wasn’t the only speaker with cybersecurity experience – hard won or otherwise – to emphasize the importance of planning as part of any effective cyber response plan.

Government officials detailed that the number one online threat facing the country continues to be ransomware.

For improving an organization’s cyber resilience in the face of that and other top threats, Alan Gray, head of national cybersecurity and resilience for the Scottish government, highlighted running cyber exercises as perhaps the single best strategy, not least because it drives organizations to continually assess and refine what they do.

After a sustained improvement effort, Gray said that 63% of public sector organizations now test their resilience policies annually, with the government pushing to get that figure to 100%.