Penfold Motors cyber incident
7 September 2026
Penfold Motors is investigating a contained cyber incident involving an external software provider, which resulted in an unauthorised party gaining access to some of Penfold Motor’s data which was stored in the software provider’s system.
Our investigation into this incident is ongoing, but at this stage we believe that the information involved is limited to basic contact details and vehicle and servicing information.
While there is no indication that this presents significant or immediate risk, we are notifying you proactively to make you aware of this incident and provide guidance on precautionary steps you can take.
There is no impact to dealership operations across our network.
Key information:
As soon as we became aware of this incident, we activated our incident response plan and took precautionary steps to protect our environment. This included working with the third-party software provider and external forensic and cyber security experts to investigate what happened and assess the extent of the impact
The incident was quickly contained and systems safely restored. Our dealerships are operating as usual.
Impacted information
Our investigation indicates that the following types of information may have been accessed as part of this incident:
- Basic contact information (e.g. name, address, email address and/or phone number)
- Customer vehicle information (e.g. registration, vehicle identification number (VIN) and/or vehicle make, model and year)
- Service information (e.g. service history, faults and/or transaction amounts)
It is important to highlight that not all of these types of information were accessed for every individual. We recommend you consider what information may have been collected as part of your dealings with Penfold Motors and consider the associated guidance below.
While we don't expect that any additional information is involved, if additional details are identified we will follow up directly with those individuals in line with our obligations.
What are we doing?
We are continuing to work with the relevant experts and the third-party software provider responsible for the system impacted by this incident. This includes assessing online claims made by an unknown party that they hold information belonging to Penfold Motors.
We have enhanced monitoring in place and have notified the Australian Cyber Security Centre (ACSC) and Office of the Australian Information Commissioner (OAIC).
Next steps
You do not need to take any specific action, but we recommend remaining vigilant for suspicious communications, including phishing emails, unexpected phone calls or messages asking you to provide credentials or click a link.
If you have any other questions, please contact our team at on 1300 420 228 or customer.support@penfold.com.au.
The Penfold Motors Team
Cyber Security Guidance
What precautionary steps can I take?
We recommend you take the following steps to help protect yourself against these scams.
Contact information (e.g. name, mailing address, and/or email address)
We recommend you remain aware of the risk of phishing emails and scams.
Scam calls and phishing emails are becoming increasingly sophisticated and can appear to come from real email addresses or phone numbers with local area codes.
They will often claim to be contacting you from a reliable organisation, such as a government entity, bank, or telecommunications agency. They will also create a sense of urgency to try to get you to share sensitive information or to trick you into transferring funds.
Where your contact information has been impacted, it is important to:
- look out for email, phone and text-based scams. Do not share your personal information with anyone unless you are confident about who you are sharing it with;
- when you’re on a website that is asking for your login credentials, take note of the web address or URL. The URL is located in the address bar of your web browser and typically starts with https://;
- if you are suspicious of the URL, do not provide your login details. Contact the entity through the usual channels to ensure you are logging into the correct web page;
- enable multi-factor authentication for your online accounts where possible, including your email, banking, and social media accounts;
- ensure you have up-to-date anti-virus software installed on any device you use to access your online accounts; and
- follow the Australian Competition and Consumer Commission's Scamwatch guidance for protecting yourself from scams here: https://www.scamwatch.gov.au/get-help/protect-yourself-from-scams/.
For more information, you can visit the OAIC’s tips for further guidance about protecting your identity: https://www.oaic.gov.au/privacy/your-privacy-rights/tips-to-protect-your-privacy/.
Customer vehicle or service information
Information about your vehicle, its service history or associated transactions does not affect ownership of your vehicle or provide access to your financial accounts. However, exposure of this information may increase the risk of targeted scams, phishing attempts, or unauthorised parties using details about your vehicle or service history to appear legitimate when contacting you.
We recommend you remain vigilant for unexpected communications relating to your vehicle, servicing, repairs, warranties, recalls, registration matters, insurance claims, toll notices, or payment requests. If contacted, we encourage you to verify the identity of the caller or organisation before sharing personal information or making any payment.
Please consider this advice and your own circumstances and exercise caution when responding to any unsolicited communications relating to your vehicle or service history.
Who can I contact for more information about cyber security?
- Additional general resources on identity and cyber security support can be found here:
If you have any other questions, please contact our team on 1300 420 228 or customer.support@penfold.com.au.
