A business owned by Kent County Council was struck. Commercial Services Group (CSG) was compromised which meant that, unlike the name, some systems were out of commercial service.
From what is currently made public, £800,000 worth of Bitcoin ransom was requested, again showing another successful ransomware attack. However, no ransom was paid. Some of the information was then leaked to the Internet.
CSG confirmed no personal data was lost, which is good. “Only” business and corporate information was compromised. However, the company is now firefighting to get its systems back online.
With an annual revenue of circa £350million and with 700 staff, this attack is a big hit as CSG offers commercial services to authorities, emergency services and schools, utilities, and more. It is not a good time during Covid-19.
It bears the hallmarks…
A statement made that the ransomware attack managed to avoid 3-levels of professional IT security. What does that even mean? A spokesperson mentioned that it “bears the hallmarks of starting with a phishing email that was used to introduce a virus that then compromised the network for further attack”. Well that’s kind of the idea if you want to get through the techie defences by hacking the human.
And KCS says it will “take learning from the incident” as it took over four weeks for the majority of systems affected to be put back online. That’s quite of a long time in terms of an incident response plan and if they were testing their plan at least annually.
KCS was informed from the ICO that no legal action would be taken against it. Case is closed.
What can we all learn from this?
#StayHomeSaveLives, #cybersecurity , #infosec, #informationsecurity, #security, #datasecurity, #datasecuritybreach#personaldata#gdprcompliance#dataprotection#pcidss#gdpr#cyberattack#dataprivacy