Storm Ransomware Group Targets Australian Auto Sector in Latest Cyberattack The Storm ransomware group has struck again, this time compromising Penfold Motors, a Victoria-based automotive dealership, in an attack first disclosed on 17 August. The hackers initially misidentified their victim as a similarly named UK organization before correcting their leak post, which now includes stolen data such as staff efficiency reports, customer details, vehicle identification numbers (VINs), and tax invoices. Penfold Motors confirmed the breach on 7 September, stating that the attack originated from a third-party software provider used by the company. While the dealership’s systems have since been restored and operations resumed, the incident exposed basic contact details and vehicle/servicing information though no identity documents or financial data were reportedly compromised. Affected individuals have been notified, and the company has engaged external forensic experts to investigate, while also reporting the breach to the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC). This attack is part of a broader campaign by Storm, which has targeted over 50 victims since its emergence in August, with a particular focus on Australian automotive, trucking, and farm machinery sectors. Recent victims include Sharp Motor Group and Macquarrie, both of which confirmed breaches tied to third-party IT providers. Penfold Motors, part of the Peter Warren Automotive Group, operates six locations across Victoria and has been a fixture in the Australian auto industry since 1964. The incident underscores the growing threat of supply chain attacks, where cybercriminals exploit vulnerabilities in external vendors to access larger networks.

Storm Ransomware Group Claims Breach of Australian Farm Machinery Dealer Agrimac The Storm ransomware group has alleged a cyberattack on Agrimac, a Warrnambool-based farm machinery dealership in Victoria, Australia. The hackers posted details of the breach on their darknet leak site on 26 August, setting a 13 October deadline for publication if demands are not met. Storm shared 16 documents as proof of the attack, including payroll records, customer contact details, risk assessments, and sales invoices. The leak page has been viewed 934 times since its posting. Agrimac has not responded to requests for comment. Storm, a relatively new threat actor that emerged in August, has listed 41 alleged victims to date, with five in Australia, including Ramsey Bros, Westco Motors Cairns, and Sharp Motor Group. Sharp Motor Group confirmed a cybersecurity incident last week, attributing it to a third-party IT provider breach, though it remains unclear if other victims were similarly compromised. Most of Storm’s Australian targets have been automotive or farm machinery dealers. The group describes itself as a "premier, results-driven firm" operating at the intersection of high finance and strategic services. Agrimac operates three dealerships in Warrnambool, Hamilton, and Horsham, specializing in Kubota and Krone machinery, with over 40 employees. The full extent of the breach, including ransom demands and data volume, remains undisclosed.

Storm Ransomware Group Strikes Again, Targets Fourth Australian Automotive Dealer The Storm ransomware group has claimed its fourth Australian victim, listing the Sharp Motor Group on its leak site on 23 August. While the full extent of the stolen data remains undisclosed, the hackers have released samples as proof, including employee passport and driver’s license scans, financial records, customer invoices, and login credentials. Storm has threatened to publish the entire dataset on 14 September if demands are not met. Sharp Motor Group, which operates dealerships in Tweed Heads, NSW, confirmed the incident, stating that its third-party IT provider was compromised. The company is working with independent cybersecurity experts and authorities, including the Office of the Australian Information Commissioner (OAIC), to investigate. A spokesperson emphasized that customer and staff privacy remains the top priority. Storm, a relatively new ransomware operation, has rapidly expanded its victim list, claiming 26 targets since its emergence this month four of them Australian, including Ramsey Bros and Westco Motors Cairns. The group positions itself as a "premier, results-driven firm" and actively recruits affiliates, while avoiding attacks on organizations within the Commonwealth of Independent States (CIS). Sharp Motor Group, known for its new and used vehicle sales, trade-ins, and financing services, serves customers in Tweed Heads, the Northern Rivers, and the Gold Coast. The breach highlights the growing risk of supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors to gain access to larger targets.