Car seller Eagers still expects a record result despite cyber attack hit

The cyber incident is mainly affecting the car dealership group’s ability to finalise sales for new cars and some service and parts activities.

A cyber attack has left Eagers Automotive unable to finalise some new car sales in a hit to its end-of-year trading, although the nation’s largest car seller still expects to post a record underlying profit.

Eagers says the cyber incident disrupting parts of its operations across Australia and New Zealand will impact its 2023 result, although not materially.

The main impact of the outage will be the deferral of some transactions from the last five days of December, centred on cars sold and ready for delivery.

“While the majority of our dealerships remain open and continue to trade, the extent of the operational impact of the outage is varied across our regions and business units,” Eagers said in an update on Friday.

“The disruption is primarily impacting our ability to finalise transactions for certain new vehicles which have been sold and ready for delivery and some aspects of the company’s service and parts operations.”

Eagers has been left unable to complete deals as a result of the cyber attack.

The company said the financial impact of the cyber incident for the 2023 year will primarily relate to the deferral in recognising some transactions across the final five days of December. Those transactions will be recognised in the 2024 financial year.

“Although the company’s statutory profit before tax for the 2023 financial year will be impacted by the cyber incident, predominantly as a result of the deferred sales, the impact is not expected to be material,” Eagers said.

“In any event, the company remains confident that it will deliver a record underlying operating profit before tax for the 2023 financial year.”

Eagers posted a record underlying operating profit before tax of $405.2m in 2022, while its statutory pre-tax profit dipped to $442.2m.

The company continues to investigate the cyber attack, which it revealed on Wednesday, and whether any customer data has been compromised.

“A primary focus of the investigation is to understand whether any personal information has been impacted. This remains under close review,” Eagers said.

“Should our investigations reveal any unauthorised access to personal information, the company will notify affected individuals in accordance with our obligations.”

The group has more than 300 dealerships across Australia in all states and territories, as well as in New Zealand, and owns Australia’s largest national fixed price pre-owned automotive business, easyauto123.

Eagers has annual revenue of $8.5bn and a brand portfolio that includes BMW, Jaguar, Land Rover, Nissan, MG, Skoda and Volvo.

Eagers and Yakult Australia are the latest companies to be hit with a cyber attack, with ransomware group Dragonforce claiming to have stolen 95Gb worth of data from the probiotic drink maker.

Melbourne-based Yakult posted a message to its website on December 23 advising it had been subject to a cyber incident.

Yakult said it had notified the Australian Cyber Security Centre, the New Zealand National Cyber Security Centre, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner New Zealand.

“Our investigations are ongoing,” Yakult said.

The recent cyber incidents follow the high profile attacks on Medibank and Optus, the latter resulting in the personal information of 9.8 million Australians being stolen, and both of which have resulted in class action lawsuits.