Your IT Provider Has a Key to Every Computer You Own. Ask Them Where They Keep It.

Sharp Motor Group runs a pair of dealerships at Tweed Heads, about five minutes from the Gold Coast airport, selling new and used cars and doing trade-ins, servicing and finance. On 23 August a ransomware crew calling itself Storm added the business to its dark web leak site, and Cyber Daily reported the listing on 28 August. Storm has not said how much data it is holding or what it wants for it, but it has published a sample as proof. The sample includes passport and driver's licence scans belonging to employees, financial data, customer invoices, and a set of passwords and user IDs, and the group says the rest goes up on 14 September.

The dealership's own statement is the part worth reading twice. "Sharp Motor Group is aware that our third-party IT provider has been involved in a cyber incident," a spokesperson told Cyber Daily, adding that the company is working with independent specialists and has notified the OAIC. So nobody phished a salesperson at Tweed Heads, and nobody guessed the service manager's password. Somebody got into the firm that Sharp pays to look after its computers, and the dealership's data left through that door.

Storm surfaced in August and had already posted 26 alleged victims worldwide, four of them Australian. Ramsey Bros, a farm machinery distributor that has been on the Eyre Peninsula for seventy years and runs six dealerships serving more than 5,000 farms and businesses, was listed on 17 August, as was the BMW and MINI dealer Westco Motors Cairns, with Sharp Motor Group following six days later. Three vehicle and machinery dealers inside a fortnight is unlikely to be a coincidence.

Update, October 2026: On 15 September the Australian software firm Auto-IT told Cyber Daily that a small number of its customer environments had been affected by an unauthorised external party, through misuse of a third-party remote monitoring and management tool. Sharp Motor Group, Penfold Motors and the machinery management specialist Macquarrie have each confirmed incidents linked to a third-party provider, and Cyber Daily understands this is the Auto-IT incident, although Auto-IT has not named them. Storm now has more than 50 alleged victims, most of them Australian car and farm machinery dealers.

Why this one matters if you run a small business

A great many small businesses have outsourced their entire security posture without ever describing it that way. The IT provider holds the administrator passwords, has remote access into every machine in the building, manages the backups and often stores a copy of the data as well. That arrangement is usually sensible, because a nine-person dealership cannot employ a systems administrator and should not try, but it means the provider's security is now your security and hardly anyone asks about it. Most of us would read three reviews before booking a plumber and then sign a managed IT contract on the strength of a friendly rep and a reasonable monthly price.

Think of your IT provider as the locksmith who keeps a copy of every key you own. You have to trust someone with them, and you are right to, but a sensible customer still asks where the key cabinet is, who can open it and what happens the day somebody breaks in. Nobody sat down and chose Sharp Motor Group. It was on a list that somebody else had already stolen.

Three things to actually do this week for reassurance

1. Put three simple questions to your IT provider in writing. Ask whether they use multi-factor authentication on every account their staff use to reach your systems, where your backups are held and when they last restored from them, and whether they will tell you within 24 hours if they are breached. A provider who will not put the answers in an email has told you something useful.
2. Find out how far your provider's access reaches. If one compromised account at their end unlocks every computer you own, that account needs a second factor and some limits, and any competent provider can arrange both without much fuss. See the suggested email text at the very bottom of this page for this and 1. above.
3. Empty the drawer of personal documents you no longer need. Sharp's leaked sample includes staff passport and licence scans, and nearly every business has a folder like that, collected during onboarding years ago and never reviewed. It is the cheapest risk on this list to remove.

By the numbers

• Breaches involving a third party: 48% of all breaches, up 60% on the previous year [Verizon Data Breach Investigations Report 2026]
• Third-party organisations that fully fixed missing multi-factor authentication on their accounts: 23% [Verizon Data Breach Investigations Report 2026]
• Cost of cybercrime to the average Australian small business: $56,600 AUD per incident, up 14% [ASD Annual Cyber Threat Report 2024-25]
• Small and medium businesses exposed to a scam in the past year: 82%, with 1 in 5 reporting an actual cyber incident [Australian Banking Association, reported by Cyber Daily, 1 September 2026]

Sources

• Exclusive: Sharp Motor Group confirms third-party cyber incident in wake of ransomware claims (Cyber Daily, 28 August 2026)
• Exclusive: Westco Motors Cairns suffers alleged ransomware attack (Cyber Daily, 24 August 2026)
• Exclusive: Ransomware newcomers list South Australia's Ramsey Bros as hacking victim (Cyber Daily, 20 August 2026)
• Exclusive: Aussie software firm Auto IT confirms customers compromised by Storm ransomware attack (Cyber Daily, 15 September 2026)
• Exclusive: Penfold Motors latest car dealer to fall victim to the Storm ransomware group (Cyber Daily, 14 September 2026)
• 4 in 5 SMEs report being exposed to scams (Cyber Daily, 1 September 2026)
• Annual Cyber Threat Report 2024-25 fact sheet for businesses and organisations (ASD, October 2025)
• 2026 Verizon DBIR: third-party risk is now breach risk (Safe Security, 2026)
• Verizon DBIR 2026 findings (Help Net Security, 20 May 2026)