Westco Motors Cairns Data Breach

Storm ransomware has listed Westco Motors Cairns, an automotive dealership located in the Cairns region of Queensland, Australia, on its dark web portal. The listing occurred on August 18, 2026, and was identified via SOCRadar’s Dark Web Monitoring service. This incident is part of a concerning pattern where multiple Australian organizations were targeted and listed on the same day. This suggests a potential shared initial access vector, such as a broad scanning campaign or a single initial access broker, rather than isolated, individually targeted attacks. The nature of Westco Motors Cairns’ business, operating under westcomotors[.]com[.]au, may attract such activities due to the potential for valuable data and financial impact. In the 60 days preceding this listing, Storm claimed responsibility for 24 other victims. The primary geographic focus for the group during this period has been the United States, Australia, and Canada. The healthcare and manufacturing sectors have been the most frequently targeted industries by Storm. The simultaneous listing of other Australian entities on August 18, including Ramsey Bros, 3-point Australia, and Penfold, supports the theory of a large-scale, batch acquisition of victims. This coordinated targeting pattern among diverse sectors within Australia indicates a potential strategic approach by the ransomware group.

A query of stealer-log data for westcomotors[.]com[.]au returned no records within the analyzed sample. It is crucial to note that this result is based on a paginated and bounded dataset. Consequently, the absence of records does not definitively confirm that the organization is unaffected. Stolen credentials could still exist under associated corporate domains or through staff personal aliases that were not included in this specific query. If a more comprehensive sweep also yields no results, the lack of evidence is informative but not conclusive proof of no compromise. Storm’s typical operational methods often involve obtaining initial access through the exploitation of stealer logs, which are subsequently validated against remote access portals such as VPNs or Microsoft 365 accounts. It is possible that such credentials may reside in data feeds that were not part of this particular analysis or have not yet been indexed. Given the typical intrusion paths employed by Storm, which often rely on validated credentials from stealer logs for access to VPNs or Microsoft 365 portals, continued monitoring is advisable. This should include vigilance for credential exposure in unsampled or future datasets, as well as proactive checks on credential hygiene and the review of access logs for Microsoft 365 and VPN services.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.