Auto-IT (AU) confirms a security incident affected a small number of customer environments through unauthorised use of a third-party RMM tool; Cyber Daily links it to the Storm ransomware wave against Australian dealers
Cyber Daily exclusive (15 September 2026) names Australian dealer-management software firm Auto-IT as the third-party IT supplier behind the recent Storm ransomware wave against Australian car dealerships and machinery suppliers.
Auto-IT told Cyber Daily a small number of customer environments were affected via unauthorised use of a third-party remote monitoring and management (RMM) tool; customers were named on a dark-web listing site with claims of accessed business data.
Company says the incident is contained, customer environments remain secure and fully operational, forensic specialists were engaged, and it is working with the Australian Cyber Security Centre and impacted customers. Cyber Daily links the wave (listings from about 18 August) to dealers including Westco Motors Cairns, Ramsey Bros, Penfold Motors, Sharp Motor Group, Agrimac, and Macquarrie — several of which already have desk cards noting an unnamed third-party supplier.
Primary: Cyber Daily with Auto-IT quotes; related desk cards: penfold-motors-storm-20260914, macquarrie-storm-20260903.
Correction (22 Oct 2026): the headline previously said Auto-IT confirmed Storm ransomware; Auto-IT's statement does not name Storm, and the Storm link is Cyber Daily's reporting. (source: https://www.cyberdaily.au/security/14188-exclusive-aussie-software-firm-auto-it-confirms-customers-compromised-by-storm-ransomware-attack)
- Product
- Auto-IT dealer management / customer environments (third-party RMM abused)
- Exploited in Australia?
- yes
- Patch to
- Auto-IT customers: follow vendor incident guidance; review RMM access, rotate credentials, confirm forensic containment; report via ACSC if impacted
