Should your Human Resources (HR) experts be more involved in assessing and protecting your organisation from cyber attacks?
Employees at some of the UK’s biggest employers – including the BBC, Boots, Aer Lingus, and British Airways – will all be rightly concerned at the potential loss of their personal data to cyber criminals as part of the widely reported MOVEit hack.*
This is not the first large-scale cyber-attack on British business and is unlikely to be the last. Yet we believe that this latest round of online criminality should function as the catalyst to finally place cyber security at the front and centre of Human Resources thinking.
According to Steve Herbert, Wellbeing and Benefits Director at Partners&: “Cyber security experts often point to the “human element” as the inconsistency which – deliberately or accidentally – enables criminals to find an access route into their employer’s computer systems. And, although this latest attack doesn’t appear to be the result of employee actions, it has nevertheless led to the theft of sensitive employee data as the ultimate objective of criminal activity.
Matthew Clark, Cyber Director at Partners&, reminds employers that government figures published last year indicate that almost 4 in every 10 employers (39%) reported at least one cyber attack in the previous 12 months, whilst fewer than 15% of the UK’s small and medium-sized enterprises have a standalone cyber insurance policy in place.
To understand more about cyber risk and how employers can protect themselves from cyber attacks visit the Partners& cyber hub.
The MOVEit hack – a cyber event impacting HR and recruitment sectors
Organisations worldwide face persistent threats from hackers and cybercriminals who are constantly seeking vulnerabilities to exploit. One significant event that has shaken the HR and Recruitment communities recently was the MOVEit software hack, resulting in the breach of personal data on potentially millions of individuals including home addresses, dates of birth, national insurance numbers and bank details. There are critical implications for both the businesses involved and the individuals concerned.
MOVEit is a managed file transfer software product that enables users to store and share sensitive information securely. The National Cyber Security Centre (NCSC), the UK’s cyber watchdog, was quick to publish an advisory bulletin on this latest mass hack, describing it as a “SQL injection vulnerability”, a method of attack long favoured by cyber criminals where malicious code is inserted into a website’s database to manipulate or access unauthorised data. Though the attack method was long-established, this was the first time the weakness was uncovered, making it a so-called “Zero-day” vulnerability.
Progress Software Corporation, the US company behind MOVEit, has issued a software update that patches the vulnerability. However, with companies like British Airways, the BBC and Aer Lingus already impacted, the contagion is likely to be much broader.
A notable feature of this cyber-attack is its focus on the software “supply chain.” By compromising a single organisation within a supply chain (in this case Progress), attackers can potentially access and disrupt multiple organisations that depend on it. This allows them to maximise the impact of their attack and target high-value assets across the supply chain.
The attack highlights the value cyber insurance can bring to professionals in HR, Recruitment, and Umbrella firms.