News: 1632830471

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

UK umbrella payroll firm GiantPay confirms it was hit by 'sophisticated' cyber-attack

(2021/09/28)


Giant Group, the umbrella company that has thousands of contractors on its books, has been targeted by a "sophisticated" cyber-attack that floored systems and left workers out in the cold, the biz has now confirmed.

The attack happened last Wednesday (September 22) and forced the outfit – known to many as Giant Pay – to shut down its whole network, including its phone and email systems, as well as its IT infrastructure.

It said last night it was still working on a "technical issue that is preventing us from getting the giant umbrella and giant accounts portals back up and running."

[1]

The incident blew up last week when contractors, many of whom work in IT, were [2]unable to contact the company or carry out payroll-related tasks .

[3]

[4]

In a statement issued last night, Giant Group said:

Giant Group was the victim of a sophisticated cyber-attack on September 22nd. International law firm Crowell & Moring immediately put in place a team of experts in the US, UK and Brussels who have been carrying out necessary steps as part of the ongoing investigation.

Together, we continue to work with our insurers, the ICO and the NCA on the investigation, alongside a number of other specialist advisers.

Giant Group went on to imply that its reticence to share information was down to the nature of the attack, saying it had shared updates as soon as it was advised that it was "safe to do so."

At this stage it's not known who is behind the onslaught and the company has not responded to questions over whether the attackers used ransomware.

A National Crime Agency spokesperson told The Register : "The NCA is aware of an incident affecting Giant Group Ltd and we are working with partners to better understand its impact."

[5]

The Reg also asked The ICO and Crowell & Moring for comment.

According to reports from irate workers, there are still some discrepancies over pay, which the firm says it hopes – but cannot confirm as yet - to resolve by the end of the week.

The company also confirmed that it had made interim payments to more than 8,000 contractors who are paid for work they do with other companies and organisations via the payroll services provider. It is not clear if everyone who is due money has been paid, or if they have received their full amount.

[6]Another UK government limb that can't get IR35 right: Court service pays taxman £12.5m

[7]Contractors argue umbrella companies need improved regulation, not outright ban

[8]Tech contractor loses IR35 tribunal appeal: 'Right' to substitute didn't mean he could, say judges

[9]Subcontractors working on CityFibre's £45m Derby rollout threaten to 'rip up tarmac' in dispute over payments

Giant Pay added: "Although we had no portals to operate from, we managed to pay over 8,000 workers last week. We appreciate that not everyone would have received their expected payment and for that we are sincerely sorry. We are aiming to be able to process your payroll and pay you by Friday."

But despite the assurances, it seems contractors are still pulling out their hair over the lack of communicationn.

[10]

One wrote on Monday evening: "This is now really frustrating. Like everyone else, I was waiting to get paid on 24th September

when it had promised to process payments

, but I did not receive any communication from them that this won't happen. It was later in the evening on Friday that I saw the message on their website.

"Now this is Monday evening 27th Sept, we still haven't received any form of communications from Giant Pay, neither have they updated us on what exactly is going on."

Acknowledging the problems faced by contractors Giant Group said it knows "everyone is frustrated about the lack of communication". Further updates will be published on its [11]website . ®

Get our [12]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YVM8USaTL50Wq@dkxZo81gAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://www.theregister.com/2021/09/24/giant_pay_outage_uk/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVM8USaTL50Wq@dkxZo81gAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVM8USaTL50Wq@dkxZo81gAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVM8USaTL50Wq@dkxZo81gAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2021/08/23/uk_court_service_ir35/

[7] https://www.theregister.com/2021/07/30/umbrella_company_ban_regulation/

[8] https://www.theregister.com/2021/06/15/techie_robert_lee_loses_ir35_tribunal_appeal_to_hmrc/

[9] https://www.theregister.com/2021/07/23/cityfibres_derby_rollout_dispute/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVM8USaTL50Wq@dkxZo81gAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[11] https://www.giantpay.co.uk/

[12] https://whitepapers.theregister.com/



It is always "sophisticated"

katrinab

Anything involving computers is sophisticated.

Re: It is always "sophisticated"

Headley_Grange

Sophisticated is an interesting word. In English it used to mean "corrupted, adulterated, tampered with" (my OED from 1954). It changed some time in the latter half of last century to mean whatever it means today - elegant, complicated, modern, whatever.

Seems that the sophisticated attack made GiantPay's systems more sophisticated.

Re: It is always "sophisticated"

cyberdemon

It has to be "sophisticated" otherwise it's an admission that "our cybersecurity was incompetent"

Re: It is always "sophisticated"

katrinab

Or under-funded

Re: It is always "sophisticated"

UCAP

Or completely non-existent.

Alan J. Wylie

I knew before I followed the link that what the first comment would say!

"Tech contractors" ?

Steve Button

Actually, if they were "Tech contractors" they would not be working through an umbrella. They are payrolled employees working through an intermediary.

Re: "Tech contractors" ?

Fruit and Nutcase

The smoke and mirrors of a contingent worker being employed through an umbrella company. All the risks and disadvantages, and none of the implied advantages

Sophisticated

Uplink

I'm guessing that their "senior" Laravel "developer" didn't bother himself with junior-level stuff such as "syntax" and "preventing SQL injections", and "concerned themselves with the bigger picture"

I'm channelling some anecdotes I got from a friend who is conducting hiring interviews and so far has rejected all the "senior" developers that came his way, with one of them saying more or less what I said in the first paragraph.

All things are either sacred or profane.
The former to ecclesiasts bring gain;
The latter to the devil appertain.
-- Dumbo Omohundro