Cyber attack on Toyota hits customers, dealers
BY TERRY MARTIN | 22nd Feb 2019
TOYOTA Australia was hit by a malicious cyber attack this week which has crippled its corporate IT systems and forced the market-leading automotive brand to set up an emergency call centre to handle customer enquiries as issues such as vehicle servicing delays kick in.
One of at least three cyber security incidents to hit the headlines in Australia this week, the attack on Toyota was revealed by the company on Thursday – two days after it became aware of the threat – and remedial work was continuing on Friday with international cyber crime experts on the case.
Toyota Australia said in a statement issued on Friday afternoon that “at this stage, we do not believe that customer or employee data has been compromised”.
However, the company confirmed a number of its corporate IT systems were still offline, including its email servers and certain programs linked with its network of 279 dealers nationwide.
Dealers have remained open for business, however the attack has caused disruptions in areas that require communication back to Toyota Australia, such as parts supply.
Toyota said this has subsequently caused servicing delays at some dealerships.
The emergency call centre number is 1800 462 000 and will run from 8am to 6pm AEDT – not including Sunday – until normal operations are restored.
All enquiries, including those relating to the Takata airbag recall, will be handled through the emergency centre.
Callers will be requested to provide their best contact details, the name of their closest or preferred dealership and information on their vehicle, including VIN and registration.
Asked whether Toyota knew who was behind the cyber security attack, including where it was mounted and whether it involved a ransom, a spokesperson told GoAuto that the company had “no further information about the origin of the attempted cyber attack”.
The company also said there had been “no enterprise-wide directive to send employees home” in the wake of the attack and the subsequent shutdown of its IT systems.
“We apologise for any inconvenience and continue to thank customers for their patience as we work to resolve the situation,” the company said in the statement.
This is understood to be the first time Toyota Australia has been the target of a cyber attack.
In its initial statement on Thursday, Toyota said: “The threat is being managed by our IT department who is working closely with international cyber security experts to get systems up and running again.”
The attack on Toyota Australia came as the Melbourne Heart Group, a specialist cardiology unit operating out of Cabrini hospital in Malvern, also confirmed this week that it had suffered a cyber attack in late January.
The incident reportedly compromised the medical files of up to 15,000 patients, with the intruder demanding a ransom.
A spokesperson for the Melbourne Heart Group said the cyber security incident meant its patient data was encrypted, preventing accessibility of patient information “to anyone, including ourselves”.
“We have been assured that no patient’s privacy has been compromised in any way,” the spokesperson said.
“We are working through this issue with our IT provider and hope to resolve it as soon as possible.”
On Monday (February 18), Australian prime minister Scott Morrison also informed federal parliament that political parties including Liberal, Labor at the Nationals had been hit, some weeks ago, by a “malicious intrusion” into the computer network of parliament house in Canberra.
“Our cyber experts believe that a sophisticated state actor is responsible for this malicious activity,” Mr Morrison said.
“The methods used by malicious actors are constantly evolving and this incident reinforces yet again the importance of cyber security as a fundamental part of everyone’s business.
“The Australian government will continue to take a proactive and co-ordinated approach to protecting Australia’s sovereignty, our economy and our national security.”
The prime minister later clarified that “state actor” meant it was a foreign government that had made the attack but said he was not able to attribute this to any particular nation.
