9:07 am, April 17, 2026
Scottish motorists have been given the green light to pursue major group legal action against car dealer Arnold Clark after thousands of customers had their data leaked on the dark web as part of a significant data breach.
The Car Dealer Top 100 table topper fell victim to the hack back in late 2022 and victims have already launched High Court action in England.
A judge has now cleared the way for 15,000 customers to launch a similar claim north of the border, in a move which could have major ramifications for the dealer group’s coffers.
The decision, issued yesterday (Apr 16) by the Court of Session in Edinburgh, came despite Arnold Clark trying to block the action from taking place.
The firm’s lawyer, Roddy Dunlop KC, argued that the customers should be added to the existing claim in England, rather than being allowed to take separate action.
However, that argument was rejected by Lord Sandison, who ruled that the English claim should not stand in the way of similar action in Scotland.
In his written judgement, he said: ‘‘Over 95% of the group members in the proposed litigation are domiciled in Scotland.
‘They entered into a contractual relationship in Scotland with a company registered here which was governed by Scots law.
‘As a consequence of their domicile, the loss and damage for which they seek compensation was suffered, on the hypothesis upon which their case proceeds, in Scotland. Nothing about their situation has any nexus whatsoever with England.
‘The forum with the most real and substantial connection to the dispute, and that which is clearly more appropriate to deal with it, is this court.’
Customer claims are being handled by multiple saw firms in Scotland, with legal firm Thompsons previously telling The Sunday Post that it had been approached by more than 5,000 victims of the data leak.
Patrick McGuire, a partner at the firm, told the newspaper: ‘I think this is the tip of the iceberg. The most financially sensitive data has been posted on the dark web and certainly includes data that would allow criminals to steal people’s identities and open fraudulent bank accounts.
‘Our clients are understandably very worried’.
Glasgow-based law firm Jones Whyte also says it has been contacted by more than 1,000 customers, who have been told by Arnold Clark that their data was included in the breach.
Associate Dominic Ritchie said: ‘We are in the process of building a strong case and will be looking for significant compensation from Arnold Clark for our clients.’
Top London solicitors Keller Postman previously told Car Dealer that as much as 45GB of customers’ personal data had been leaked on the dark web by hackers.
The breach initially took place on December 23, 2022, with Arnold Clark initially claiming that there was ‘no evidence of customer information being compromised’.
However, the dealer group later said that names, dates of birth, vehicle information, contact details and National Insurance numbers had been stolen by hackers.
Car Dealer has approached Arnold Clark for comment.
