TL;DR: Australian dealer software maker Auto-IT confirmed that a small number of its customers were named on a dark web listing after a security incident involving a third-party remote monitoring tool. The Storm ransomware group has listed several Australian car dealers since August 18. If you bought or serviced a car recently, watch for dealer-impersonation messages.
👉 See if your data's already leaked — free 30-second check →
Cyber Daily reported on September 15, 2026 that Auto-IT, which makes dealer management software, confirmed a small number of customer environments were affected. Auto-IT said the incident involved the unauthorised use of a third-party remote monitoring and management tool, and that it is working with the Australian Cyber Security Centre and impacted customers.
What is known
- The Storm ransomware group posted its first victim on August 7 and began listing Australian car dealerships and machinery suppliers on August 18.
- Listed businesses included Westco Motors Cairns, Ramsey Bros and Penfold Motors, with Sharp Motor Group and Macquarrie following.
- Sharp Motor Group, Penfold Motors and Macquarrie confirmed their incidents were linked to a third-party cyber incident, which Cyber Daily understands is the one Auto-IT disclosed.
What buyers and service customers face
Dealer records typically hold names, addresses, phone numbers and vehicle details. That is enough for convincing messages such as a fake service invoice or a demand to update payment details. The attackers claim access to data relating to dealer businesses, and the sources we reviewed do not say what customer data was included.
What to do
- Never pay an invoice or change bank details based on an email or text alone. Call the dealer on a number you already had.
- Watch for messages that mention your vehicle model or service history. Our guide to shopping and payment scams covers the pressure tactics used.
- If an Australian dealer notifies you of a breach, follow the recovery steps in the Scamwatch and IDCARE recovery process.
- Check what else is public about you with data broker opt-out options for the UK, Canada and Australia.
FAQs
Was my car dealer affected by the Auto-IT incident?
Several dealers have confirmed incidents linked to a third-party cyber incident. Ask your dealer directly, and rely on their official notification.
What is the Storm ransomware group?
Storm is a ransomware group that began posting victims on August 7, 2026 and started listing Australian car dealers and machinery suppliers on August 18.
Should I pay a dealer invoice that arrives by email after a breach?
Verify it by phone using a number you already trust before paying, especially if bank details differ from before.
Once the immediate danger has passed, see how much of your information is already public: Use the free digital footprint checker.
Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.