Call our team

Arnold Clark Data Breach Compensation

Data breach victims have been contacting our lawyers to pursue compensation claims against Arnold Clark, for the data breach in December 2022. The Glasgow-based firm experienced a cyber attack that leaked many people’s information.

The following information was released:

  • Names
  • Contact details
  • Dates of birth
  • Vehicle details
  • ID documents (such as passports and drivers’ licences)
  • National insurance numbers
  • Bank account details


Due to the failure of Arnold Clark’s cyber security team to protect the data that they are legally obliged to keep safe from unauthorised access, they have found themselves the recipients of many data breach compensation claims. 

Have you had an account with this company before December 2022? If so, you could find yourself receiving monetary compensation for this failure. 

How do I know if I am eligible for an Arnold Clark Data Breach Compensation claim?

There is a simple and easy way to find out if you are one of the people who Arnold Clark failed to protect. They would have been legally obligated to contact you via email. However, it’s entirely possible that an email was never sent to you. It could be through mistake, but it’s worth bearing in mind that Arnold Clark did not announce the breach until a whole month after it happened. 

Nonetheless, regardless of whether or not you have the email, you can still check with us whether or not you have a claim. Simply input your details into our system through a straightforward and quick form, and we will have a specialist no-win no-fee lawyer contact you for further information. Through this call, it should become very apparent whether or not you have a legal basis to make an Arnold Clark Data Breach Compensation Claim. 

From there, you can allow the lawyer to handle all of the legal and administrative busywork. They will fight on your behalf, and when it’s over, if the case is successful, they will take a cut of the earnings. No money comes out of your pocket, only the compensation earned. This also ensures that your lawyer will be operating at their maximum potential. 

Step 1

Contact Us

Get in touch and tell us a bit about your data breach. You will likely have already been contacted by the organisation responsible for the loss of data, so have that info to hand as it will help us expedite your claim.

Step 2

Leave us to it

Once you’ve provided us with all the relevant information, your claims expert will do all the work on your behalf so you won’t have to lift a finger.

Step 3

Claims success

While not all claims are guaranteed to win, at the conclusion of a successful claim, we will aim to get you the best compensation amount possible.  You only have to pay us any fees in the event of claims success.

Our process

Our claim process gets results for our clients.

At Evans Hughes, we handle your data breach claim to maximise your chances of success. Working on a No-win, No-fee basis, you only ever have to pay our fees following a successful claim so there’s no risk of you making a claim and no upfront costs.

Start your data breach claim today.

Office hours: 9-5 Monday to Friday

Who caused the Arnold Clark Data Breach Compensation?

The culprits behind the Arnold Clark Data Breach were allegedly from a ransomware cartel named “play”. Ransomware refers to a virus that essentially holds a system hostage through software, and, as you can guess through the name, demands payment before it is released. In this case, it wasn’t a system that was kept captive, but information, with the threat of that information being released for many to see on the Dark Web if a payment was not made. 

Ransomware has become a much larger issue across the world due to the profitability of the illicit business. Typically, the random victim would end up downloading a file that would lock their computer and would be required to pay a sum in the hundreds to unlock it. In the case of Arnold Clark, a different style of ransom was demanded – a technique called “double extortion”. 

Double extortion artists target big companies, lock or take sensitive files, and demand a sum of money. Otherwise, said files would be released on the internet for all to see, causing a massive amount of stress or even financial loss as a result. Obviously, not only would this tank the company’s reputation, but they may end up facing massive losses financially from the fines from governing bodies and compensation paid out to individuals who suffered. 

What was Arnold Clark’s response?

It’s clear that Arnold Clark did not pay for the ransom, which resulted in the leak to the dark web. 

Since then, they have renewed their pledges to ensure that customer data will be protected. Some of this can be seen in their website updates. 


16th February 2023

Arnold Clark takes the protection of our customer data extremely seriously, therefore, we have now taken the decision to proactively contact customers who may have been affected to make them aware of the cyber incident, and to offer them guidance and protection in conjunction with our partners Experian.

We are working to protect our customers as a matter of priority, and we will continue this process to ensure all our customers who may have been affected by this incident are made aware and are offered assistance and protection.

Arnold Clark remains in regular contact with the regulatory authorities and is continuing to seek guidance from the police.


9th February 2023

We are continuing to work with our external advisors to identify the full scope of the data affected by the cyber incident, both from evidence available on our systems, and from information obtained from these advisors.

If any of this data relates to you a separate communication will be sent out to you directly.

We have now completed the set-up of a helpline with Experian, and have notified those customers who we have identified to date as potentially being impacted.

As you will appreciate, we are unable to provide a definite timescale for completing our investigation at the moment, as this is such a highly complex exercise. We will, however, continue to keep you regularly updated.

We thank you for your patience and co-operation.

If you need to contact us about this incident, you can do so by contacting

Of course, it’s all well and good that Arnold Clark is renewing their vows to take customer protection seriously, but it’s clear that sufficient protection was not in place initially, leading to the breach. 

As such, it is your legal right to pursue a compensation claim, should it affect you, as per the Data Protection Act of 2018. 

Eligibility for a Compensation Claim

The good thing is – it’s easy to find out if you have a reasonable compensation claim case. All you need to do is click on the “Start Your Claim” button. There is no obligation to finish or go through with any sort of claim, but by clicking the button and filling in some easy information that will take less than two minutes, you can find out if you’re eligible, and if you are, how strong your claim can be.

Understand, the lawyer assigned to you will be a specialist that works on a no-win, no-fee basis. This means nobody will expect any money from you if the case does not work out, and if you win, the money is taken from the winnings rather than your bank account.

Data Protection Act of 2018

The Data Protection Act of 2018 is what enables you to make the Data Breach Compensation Claim. It is the successor to the Data Protection Act of 1998 and is designed to ensure that you can give your private information to companies with the expectation and assuredness that your data will be protected to the best of that company’s ability. 


The following is a breakdown of what the Act entails. 

  • Personal Data – The Data Protection Act divides the data you give between personal and non-personal. Personal, of course, refers to details that pertain to your privacy. Such as addresses, names, telephone numbers etc. 
  • Rights of Data Subjects – The Data Protection Act ensures that individuals have the right to be informed when their data is leaked. In this case, Arnold Clark is supposed to have sent out an email to the addresses of each person who had their data leaked. Failure to do so could result in a higher payout. 
  • Lawful Basis – Processing of personal data has to be done on a legal, lawful basis. Meaning through consent, contract, obligation or legitimate interest. 
  • Data Protection Impact Assessments – For high-risk data processing, such as transfers and situations that require several individuals in the process. 
  • Data Protection Officer – Organisations must have officers who are in charge of ensuring the data is protected. 

Start your data breach claim today.

Office hours: 9-5 Monday to Friday

Our reviews

What our customers say...

Get in touch

Work with us

Contact us if you have a data breach enquiry and we’ll get back to you at the earliest opportunity. Use our contact form, email us, or pick up the phone and give us a call.