Update: BBC, British Airways & Boots In Supply Chain Attack

The BBC, British Airways (BA), Boots and Aer Lingus and a number of other organisations have been hit by  large sacle attacks and have warned their staff about a cyber attack that has compromised personal information. The hackers are suspected of having links to a Russian cybercrime gang called Clop. 

The payroll service company Zellis has been hit and it has said data from eight of its client firms had been stolen. Zellis has not revealed names, but organisations are independently issuing warnings to staff.

The hackers exploited a vulnerability in MOVEit Transfer software to access information from a growing number of UK firms and their staff in one exploit, although there are no reports so far of ransom demands or money stolen. The MOVEit software is popular around the world with most customers in the US. Potentially hundreds of companies using the software may be impacted.

Now, businesses affected by the exploit, including the BBC, BA and Boots now have an ultimatum from Clop

A post that appeared on the  Dark Wed overnight urges organisations affected by the hack to send an email to the gang to begin a negotiation on the crew's darknet portal. The Clop group posted its notice in broken English with a  warning to those affected by the MOVEit hack to email them before 14 June or stolen data will be published. Also among the organisations targeted were the Nova Scotia Government and the US University of Rochester.

Advice from experts is for individuals not to panic, and for organisations to carry out security checks issued by authorities like the US Cyber Security and Infrastructure Authority (CISA). Russia has long been accused of being a safe haven to ransomware gangs, which it denies. Law enforcement agencies around the world advise organisations not to pay, as it fuels the growth of cyber crime gangs. 

Kev Eley, VP Sales UK & Europe at LogRhythm  commented, "The breach shows that even well-established and trusted brands are not immune to ransomware attacks.. The attack exposed critical employee personal data, including bank, national insurance, and contact details to hackers. This highlights the growing vulnerability many companies are facing when it comes to sophisticated cyber attacks targeting flaws along their software supply chain." 

Organisations of all sizes need to recognize that ransomware attacks are a matter of ‘when’ not ‘if’ and must move from a reactive to a proactive cyber security strategy to stay ahead of relentless threats. A predictive approach that uses Threat Intelligence is absolutely crucial for gaining full visibility into the attack surface and quickly detecting the most immediate network threats.  

  • British Airways (BA) has confirmed it was one of the companies affected by the hack and its staff have been told that personal data including national insurance numbers and possibly bank details and data might have been stolen. 
  • In an email to staff, the BBC said their stolen data includes staff ID numbers, dates of birth, home addresses and national insurance numbers.
  • The Boots retail chain which employs 52,000 people in Britain, emailed employees to warn them that data including home address and national insurance numbers had been stolen.
  • Aer Lingus, which employs 4,000 people, said information on current and former employees, including their national insurance numbers, had been stolen in the breach. 

The UK's National Cyber Security Centre said it was monitoring the situation and urged organisations using the compromised software to carry out security updates.

The attack was first detected when US firm Progress Software said hackers had broken into their MOVEit Transfer tool. MOVEit is software designed to move sensitive files securely. CISA Has recently issued a warning to firms that use MOVEit, instructing them to download a security patch to stop further breaches.

It is likely the cyber criminals will attempt to extort money from organisations rather than individuals and the hackers will likely threaten to publish the stolen data online for other hackers to exploit. Staff at victim organisations need to be vigilant of any suspicious emails that could lead to further attacks. 

Graham Hawkey, Privileged Access Management (PAM) specialist with Osirium commented "Working closely with third parties, whilst bringing many benefits, adds a lot of risks unless key security measures are in place, with the right controls and monitoring...  organisations need to secure remote access without exposing the keys to their kingdom. It’s vital to separate third parties from credentials, not allow VPN access, use multi-factor authentication, and record sessions."

Christine Gadsby, VP Product Security, BlackBerry said “This attack on Zellis underscores that the global cyber risk equally applies to supply chains, as well as individual vendors. Organisations still have lessons to learn from examples like the SolarWinds hack because, all too often, the success of software supply chain attacks plays on an excess of trust. In this case, where those impacted are two-steps removed from the source of the breach, it’s clear to see why businesses can’t afford not to put effective defences in place to cover any possible exposure to attack. 

BlackBerry research has found that more than three-in-four IT and cyber decision-makers currently suffer from a lack of holistic visibility into their security posture. That’s a worrying fact, considering that the same research found that four in five software supply chains were exposed to cyber attack in just 12 months.  

Although no official attribution has been made, Microsoft is reports as saying that it believes the criminals responsible are linked to the notorious Cl0p ransomware group, thought to be based in Russia.

Zellis:   Mandiant:     Blackberry:   BBC:   BBC:      Blackberry:     Guardian:     Telegraph:   Sky:   Mirror:    Metro

Sky:    City AM:    Independent:     Mirror:    JackFM:   

You Might Also Read: 

Which CI/CD Tools Can Promote Supply Chain Security?:

____________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« British Business Moves To Adopt Digital Identity
Cyber Security Insurance - What You Need To Know »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Mako Group

Mako Group

The Mako Group specializes in protection - providing security through auditing, testing, and assessments. And, we do it all with the highest quality standards possible.

Capita

Capita

Capita is a consulting, digital services and software business, providing end-to-end enterprise IT services and solutions focused around digital transformation and innovation.

NDIA - Cyber Division

NDIA - Cyber Division

NDIA Cyber division’s contributes to US national security by promoting interaction between the cyber defense industry, government and military.

Azeti Networks

Azeti Networks

Azeti Networks is a global provider of IoT technology to a variety of verticals including telecomms, oil/gas, manufacturing, finance and healthcare.

CloudAlly

CloudAlly

CloudAlly provides online cloud to cloud backup and recovery solutions, which backs up daily changes in your SaaS to unlimited Amazon S3 storage and makes it available for restore or export.

Hexnode MDM

Hexnode MDM

Hexnode MDM is an award winning Enterprise Mobility Management vendor which helps businesses to secure and manage BYOD, COPE, apps and content.

Logic Supply

Logic Supply

Logic Supply is a global industrial PC company focused on hardware for the IoT edge. We design highly-configurable computers engineered for reliability.

Xilinx

Xilinx

Xilinx is the inventor of the FPGA, programmable SoCs, and now, the ACAP. We are building the Adaptable, Intelligent World.

CYRail

CYRail

CYRail project will analyse threats targeting Railway infrastructures and develop innovative attack detection and alerting techniques.

Sonrai Security

Sonrai Security

Sonrai Security delivers an enterprise security platform focused on identity and data protection inside AWS, Azure, and Google Cloud.

CleanCloud by SEK

CleanCloud by SEK

CleanCloud by SEK is a CSPM product focused on public cloud data protection and security regulations, with over 400 compliance checks for the market's leading frameworks and regulations.

CyberGuard Technologies

CyberGuard Technologies

CyberGuard Technologies provides a suite of fully managed end-to-end security services from its 24/7 UK security operations centre.

JaCIRT

JaCIRT

JaCIRT is the national Cyber Incident Response Team for Jamaica, established to deliver on the mandate outlined in the GoJ’s National Cyber Security Strategy.

QA Consultants

QA Consultants

QA Consultants is North America’s largest software quality engineering services firm, an award-winning onshore provider of software testing and quality assurance solutions.

VC3

VC3

VC3 provides a full range of Information Technology Solutions and Services to hundreds of municipalities and organizations throughout the USA.

NetRise

NetRise

NetRise was founded as a direct result of the many shortcomings currently in the device security market, specifically targeting the firmware of devices.