Weak Password Allowed Hackers To Sink a 158-Year-Old Company (bbc.com)
- Reference: 0178433030
- News link: https://yro.slashdot.org/story/25/07/21/1957210/weak-password-allowed-hackers-to-sink-a-158-year-old-company
- Source link: https://www.bbc.com/news/articles/cx2gx28815wo
> One password is believed to have been all it took for a ransomware gang to [1]destroy a 158-year-old company and put 700 people out of work . KNP -- a Northamptonshire transport company -- is just one of tens of thousands of UK businesses that have been hit by such attacks. Big names such as M&S, Co-op and Harrods have all been attacked in recent months. The chief executive of Co-op confirmed last week that all 6.5 million of its members had had their data stolen. In KNP's case, it's thought the hackers managed to gain entry to the computer system by guessing an employee's password, after which they encrypted the company's data and locked its internal systems. KNP director Paul Abbott says he hasn't told the employee that their compromised password most likely led to the destruction of the company. "Would you want to know if it was you?" he asks. "We need organizations to take steps to secure their systems, to secure their businesses," says Richard Horne CEO of the National Cyber Security Centre (NCSC) -- where Panorama has been given exclusive access to the team battling international ransomware gangs.
A gang of hackers, known as Akira, broke into the company's system and demanded a payment to restore the data. "The hackers didn't name a price, but a specialist ransomware negotiation firm estimated the sum could be as much as 5 million pounds," reports the BBC. "KNP didn't have that kind of money. In the end all the data was lost, and the company went under."
[1] https://www.bbc.com/news/articles/cx2gx28815wo
This is why you have offsite backup (Score:2)
If you have a small company, have a couple trusted employees (or the CEO) keep an encrypted disk at home and rotate it once a month or three.
Whut? (Score:2)
So, the hackers wrote "let's have a dialogue". Then a negotiation firm guessed "5 million pounds", and they gave up and shut down instead of trying to negotiate?
Was that for legal reasons? Scruples?
Re: (Score:3)
Surely the hackers would rather take what they could get. You pay the money and do better next time, no? I'm sure something is missing from the article.
Re: (Score:2)
Yeah it seems like there must be some details we are not getting.
Now I can imagine, that the intruders did not exfil the data just ciphered it in place. In which case they don't and never had access to the internal financial records. So if you tell them 'but we aint got 5 million pounds' they might say "f*** you you're lying pay us or get f***ed" and which point nothing you can do but say "no really best we can possibly come up with N pounds" and if they gangsters won't take it well that is the end of the
Re: (Score:1)
Yeah the whole thing is kind of fishy. Then again the British economy is basically in tatters so it's possible to company was on the edge and couldn't recover from even a small problem.
It's not the employee (Score:5, Insightful)
Blaming the employee for the failure of the company is wrong. The company failed because they didn't have good data management or access controls. If the password was compromised due to being "weak", then the company also didn't have good password controls.
Re: (Score:2, Interesting)
It's stupid records management policy. Company records MUST be write-once ... there should be no way for anyone (including and especially the upper management or admin) to delete/modify previously created RECORDS). e.g. there should be no operational way to "delete" or "modify" existing records. If you want to "correct" an error, just write another record indicating that the previous record is wrong, etc. if you want to delete a record, write another record indicating that the older record is no more.
That's
Re: (Score:1)
> there should be no operational way to "delete" or "modify" existing records.
Technically, this is very hard to do. It's much easier to set things up so there should be no operational way to "delete" or "modify" existing records without it being obvious that something out of the ordinary is going on
With the right level of access, there will be a way to copy everything from the existing media EXCEPT what you want deleted to new media. As long as this is easy to detect (say, CCTV recordings showing someone entered the server room, downed the server, removed the write-once media, use
Re: (Score:3)
"Password controls" are one of these stupid IT security myths pushed by the incompetent. All passwords of regular users need to be regarded as weak. If you need more, you _must_ add 2FA. There is no major security control catalog left that does not ask for 2FA for good authentication.
Re: (Score:2)
Prime time that is why they failed. They also failed because they didn't have backups to roll back too. The "weak link" was the IT department.
Wrong. (Score:5, Insightful)
Their company did not fail because of a ransomware hack.
Their company failed from not having adequate off-site backup of their data.
The cloud does absolutely nothing to protect you from needing a real disaster recovery plan, and any business that doesn't have one deserves what they plan for (or don't plan for).
Also: a backup that isn't tested is not a backup to bet your business on. Back up your shit, test your backups, and make sure there is a copy of your tested backup somewhere that a ransomware dipshit can't get to it, like LTO tapes in a closet in your office.
No. (Score:5, Insightful)
No; a weak password did not kill this company.
Management not investing in the most basic of backup systems is what killed the company.
Companies get their systems wiped out everyday nowadays by ransomeware hackers. Then, they pull the plug on the internet, scrub the computers, and restore from a recent backup. That is management.
This is stupidity.
Re: (Score:2)
> This is stupidity.
I would call it gross negligence instead, because you have to be entirely disconnected from the real world to not be aware of this threat.
So, no write-protected backups, no BCM and DR preparations, no strong authentication, and hence no ransomware preparedness. This is 100% on the decision makers that screwed up to an unbelievable degree.
Sorry I don't buy this excuse.. (Score:2)
> In KNP's case, it's thought the hackers managed to gain entry to the computer system by guessing an employee's password, after which they encrypted the company's data and locked its internal systems. KNP director Paul Abbott says he hasn't told the employee that their compromised password most likely led to the destruction of the company.
This would have to be the system administrator's password and even then I would say is was poor management if they had access to all.
This is a constant fight that I have with clients. Everything needs to be easy. Security is not a consideration. Then something happens and they look for answers that don't interfere with operations. Everyone else is to blame.
If the data is that important then it should have been secured behind more than one employees password.
Re: (Score:2)
> This would have to be the system administrator's password
No. "Lateral movement" is a thing. In fact, it is an entirely standard thing in such an attack.
How many more stories? (Score:2)
It was unthinkable to run a company without reliable backups 25+ years ago. Today I'd call it criminal negligent. How many more stories does the CIO need before s/he make this a priority?
Just incredible how this keeps happening.
IT department did this (Score:3)
Unless the IT dept tried to implement security and proper backups and were denied, this is the IT departments fault. Some random employee with a weak password can't cause the loss of a properly implemented network.
Re: (Score:2)
And in the real world, the responsible C-levels fired anybody that was pushing for real security and replaces them with weak yes-men.
In most cases, something like this is actually the fault of the ones that hired the IT people.
Pre-computer equivalent (Score:1)
Imagine it's 1950s or earlier. You run a business that lives or dies by paper records, such as an insurance company, land office, or something similar.
Your office burns down, taking all the data with it. You don't have off-site backups (microfilm, carbon copies, or what-not). Thankfully the fire was after-hours and nobody was hurt.
Your business is probably toast, figuratively and literally. At best, you are insured and will be able to start over from scratch, but your existing customers might prefer to
I don't understand insurance, then (Score:1)
The BBC article said that they followed current cybersecurity guidelines and had cyber security insurance.
What did that "insurance" provide, exactly, in this case?
Re: (Score:2)
Well, there is "following" guidelines and there is "following" them. And they may not even have done the fake version, but just told the press they did.
As to "cyber insurance", the insurance gives you what you have a contract for if you followed the conditions in that contract. "Cyber insurance" is an entirely unspecific term and can mean basically anything.
Bottom line is, they got hit, they were unprepared and they got wiped out. I see some very high likelihood of at least gross negligence in the C-levels.
Backups often won't help (Score:3)
A ransomeware group worth spit would have poisoned your backups so when you're having your genius moment to restore from snapshot or tape backup from last month guess what? It has ransomeware as well!
This is if you actually have encrypted, off site and immutable backups that are worth poisoning. When was the last time you checked in your company how easy it is to infect backups?
This is why some EDR solutions have anti-ransomeware mechanisms to secure contents before or as it's being encrypted.
This is also why you might have a managed SIEM service so when dodgy stuff happens on your network it can be caught early or reacted to before everything is crypto locked.
Also there you might look at replication solutions that will help you recover by restoring only parts of the data you know is safe based on signing or last update values.
The answer is not EDR or XDR or SIEM, replication, immutable backups etc etc althought that's tempting.
The answer is proportional training and defence in depth with an incident response plan to match for when shit happens you can take appropriate action.
As a security professional it is your job to consider the realistic risk to the company, the cost of the impact should an incident occur and how to mitigate, avoid, prevent or accept that risk. Ideally at a much lower cost.
When a CEO wants to know why money should be spent, AKA what is the return on security investment this story and it's impact should not be quoted. Instead it's better to understand the relevant risk and impact to the specific business of that CEO's company.
How much could a ransomeware attack cost your business? What are the odds you'll be attacked in the next 10 years? What is the cost of mitigation per year? Should you outsource? Should you get cyber insurance? Do you need a crack team of ITsec incident response professionals?
Hire a consultant today. One annual thorough annual review might save you and your employees a lot.
Re: (Score:2)
Backup poisoning? AFAIK, that is a myth. Got any references for that?
What a ransomware gang does if they can reach the backups is simply delete them.
Re: (Score:2)
> A ransomeware group worth spit would have poisoned your backups so when you're having your genius moment to restore from snapshot or tape backup from last month guess what? It has ransomeware as well!
My recent backups might be infected, but my "day of compromise minus one" backups won't.
Even if my recent backups are infected, they are likely to not be ransomware-encrypted, which means they are still useful to me.
Failure to prepare is preparing to fail. (Score:2)
Complacency and an odd loathing of "modern" technology (computers are no longer "modern" in 2025 while everyone has had decades to get familiar) among many who should know better will continue to end in tears.
I use stories like this one to remind my friends to back up their data and in at least three places (the Rule of Threes is easy for non-techies to remember).
If your business burns to the fucking ground your backup(s) should permit rapid reload from bare metal. Many Slashdotters back up our personal dat
Incompetence kills (Score:2)
And if "one bad password" is enough to kill a company, then the C-levels there screwed up massively. Probably criminally negligent at that scale.
One Punishment for This (Score:1)
Death penalty. Not only that, but public gladiatorial combat. Televised and broadcast for free. Seriously, we'll only need to do maybe 30 of these and hacking will be solved.
Backup (Score:3, Insightful)
The digital world is a cat-and-mouse game, and you don't want to be the mouse.
I'm sure a small part of the estimated 5 million pound ransom would have gotten them a decent backup system. Even a "hot spare".
Re: (Score:2)
Or hardware tokens that cannot be replicated in other continents.