Any business which stores sensitive and/ or personal data is of interest to cyber criminals since they can seek to sell this information for profit.; this covers a wide range of sectors from healthcare to financial institutions and educational establishments. The NHS is one such example since it keeps highly sensitive information including medical insurance details, National Insurance numbers and medicine records. In May 2017, the WannaCry ransomware attack prompted NHS England to declare a major cyber security incident which resulted in an approximate overall direct cost to the NHS of £92m with over 19,000 appointments cancelled.

As globalisation results in more interconnected supply chains, the risk of an attack originating through a supplier or third party increases. Many suppliers or parties can contribute to a single product or service and essentially, the more touchpoints, the greater the risk.

Organisations may struggle to gain a clear idea of security vulnerabilities in their wider supplier eco-system due to proprietary data privacy regulations or where upstream or downstream suppliers are distant in the supply chain and based abroad. The automotive industry is one such example.

Increasingly, many legal firms are choosing to partially or totally outsource services to external suppliers. The sensitive information and large amounts of money held by law firms makes them attractive targets for cyber attacks. Further, the increasing use of robotics and automation introduces new attack surfaces which can be exploited by cyber criminals. In 2018. the National Cyber Security Centre⁶ reported the most significant types of attacks on law firms as phishing (where an entity posing as a legitimate institution seeks to obtain sensitive information), data breaches and ransomware attacks.

In today’s world, most businesses rely on some sort of IT system or etrade platform, but where these are old or unsupported, they can provide an easy access point for cyber criminals. Conversely, overly complex IT systems can also pose issues due to poor patching or where they ‘talk’ to third party networks. Ransomware, DDoS (distributed denial of service) and SQL Injection are some common types of attack on IT systems. The latter, SQL Injection, is an extremely well known and easily avoidable attack that involves cyber criminals exploiting system vulnerabilities, for example by inserting code into the website search bar which enables them to amend, interact and extract from databases.

 In October 2015, telecommunications company TalkTalk reported it had been subject to a SQL Injection attack, which enabled thieves  access customers’ personal data including names, addresses, dates of birth and financial information. In total 156,959 customers’ personal details were accessed, including the bank details for 15,656 customers. A problem was first identified when internal reports showed its network was operating more slowly than normal. Further investigation found there had been an attack and TalkTalk replaced its websites with a holding page, reported the data breach to the Information Commissioner’s Office (ICO) and started telling its customers. The ICO’s investigation found that TalkTalk had failed to take appropriate measures to keep its customers’ personal data secure and issued its largest ever fine at the time - £400,000.