Six Australian dealer and machinery businesses have been listed on the leak site of a new ransomware group, Storm, after a breach at their dealer management system provider, Auto-IT. The company, which has a Wellington office and customers on both sides of the Tasman, says a small number of customer environments were reached through unauthorised use of third-party remote monitoring and management tools — the utilities a support provider uses to log in and fix things on a customer’s computer system.
Storm appeared in August and had listed more than 50 alleged victims by mid-September. Security researchers tracking the group’s StormEncryptor ransomware link it to an authentication-bypass flaw in N-central, a remote-management platform from N-able that IT providers use to look after their customers’ systems, disclosed and patched in early August. Two weeks after the patch, a large share of the N-central servers reachable from the internet were still running the unpatched version. Auto-IT has not said which tool was involved in its case, but the wider pattern is familiar: the vendor issues a fix, and the systems still exposed weeks later are the ones that have not applied it.
None of this changes the case for running a workshop on current software. A well-maintained platform, whether cloud-hosted by the vendor or on a workshop’s own server, gets its security fixes as they are released, and a cloud-hosted system takes that job off the workshop entirely. Exposure in incidents like this one often comes from forgotten edge cases, such as a remote-support tool installed years ago or a legacy application kept alive because one report depends on it.
Arctic Wolf’s 2026 threat report found 65% of intrusions outside email fraud began with abuse of remote access — RDP, VPN, or RMM tools — and its research vice-president Ismael Valenzuela describes attackers “logging in instead of breaking in, stealing data instead of encrypting it.” Storm fits that description: sample documents on the leak site, a two-week deadline, then the full dataset of customer, vehicle, invoice, and staff records.
Three questions for your software and IT providers: is our platform cloud-hosted and patched by the vendor, or are we responsible for updates? Which remote-access tools can reach our systems, and are they current? And does our cyber insurance cover a breach that starts at a third party? A workshop on a current, vendor-maintained cloud platform with multi-factor authentication on every login has already done most of the work.
