Umbrella company Parasol Group confirms cyber attack as 'root cause' of prolonged network outage
(2022/01/17)
- Reference: 1642426091
- News link: https://www.theregister.co.uk/2022/01/17/umbrella_company_parasol_group_confirms/
- Source link:
Umbrella company Parasol Group has confirmed why it shut down part of its IT last week: it found unauthorised activity from an intruder.
As [1]reported by us on Friday , the umbrella company's MyParasol portal, where timesheets are submitted, was not accessible due to a multi-day outage starting on 12 January, impacting the processing of payroll.
Tech freelancers suspected a cyberattack was to blame for the blackout and sure enough the Group wrote to customers at the close of last working week to explain in more detail what had happened.
[2]
Doug Crawford, CEO at Parasol, said in an email to customers seen by us that the "root cause" of the issue affecting IT systems "has been identified as malicious activity on our network."
[3]
[4]
Crawford – who did not confirm the nature of the break-in, widely speculated to be ransomware – added: "The activity did not enter via the core Parasol platforms, but to ensure the safety and integrity of your data, we suspended our systems to protect the Parasol community. As you know, this included the MyParasol portal and our other outbound and inbound communication channels," he said in the email.
"The ongoing forensic exercise and investigations currently indicate that your personal information has not been extracted. We would of course have preferred to tell you more immediately about that exact circumstances of our system issues but were acting to preserve the integrity of the investigation."
[5]
An "experienced team" is still "working tirelessly to resolve this matter in a safe and controlled manner," Crawford added.
"Balancing speed versus safety is crucial in circumstances such as these. We have a strong dedicated IT, Security and Infrastructure team working around the clock, alongside our pre-existing security specialists."
Crawford conceded: "We know we are not providing our usual levels of support to you. Our system constraints are such that this has been impossible."
[6]
For freelancers wanting to contact Parasol, the CEO suggested using LiveChat, emailing via ES@Parasolgroup.co.uk or calling 01925 644 860.
The Register tried to email chief sales officer Greet Brosens last week and called the switchboard but the call didn't connect.
We rang the number above today and a connecting message stated Parasol Group was experiencing a high volume of calls. We called twice and it rang and rang for a combined 11 minutes with no answer, so readers may be in for a wait.
[7]Multi-day IT systems outage whacks umbrella biz Parasol Group amid fears of a cyber attack
[8]Searching for Skylab : Even the most casual astro-nerd will revel in this respectful elegy to unsung space history
[9]Campaigns propose new rules to protect contractors from rogue umbrella companies
[10]Timekeeping biz Kronos hit by ransomware and warns customers to engage biz continuity plans
Crawford said in the email it was "continuing to make same day payments" during the last weekend to pay umbrella workers as quickly as possible. Some freelancers don't appear to have been fully paid yet, and a bunch jumped on [11]Trustpilot this morning to voice their anger about the situation.
We have asked the UK's Information Commissioner to comment. ®
Attackers hit another umbrella firm
Umbrella outfit Brookson Group was also hit by a cyber attack last week, CEO Andrew Fahey revealed Friday 14 January on [12]LinkedIn.
Fahey said the company had taken steps to "disable all the Brookson services from accessing external networks."
Its tech team was working to restore services as promptly as possible, he added.
"Fortunately, our network defences spotted and contained the attack immediately and this allowed us to contain the impact and take the necessary preventative measures to ensure no data was removed."
Fahey said the "incident has been reported to the UK National Cyber Security Centre."
At the weekend, he said security folk were "combing" through its infrastructure, with a view to "ensur[ing] a safe removal of the cyber attack is completed as quickly as possible."
The business does not know when normal ops will resume.
Phone lines are not working, because the telephony system was IP-hosted, but email is. The Connect, Workforce Manager and IR35 portal are also disconnected.
Get our [13]Tech Resources
[1] https://www.theregister.com/2022/01/14/multiday_it_systems_outage_whacks/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/01/14/multiday_it_systems_outage_whacks/
[8] https://www.theregister.com/2019/03/29/searching_for_skylab_review/
[9] https://www.theregister.com/2021/05/17/campaigns_umbrella_firms/
[10] https://www.theregister.com/2021/12/13/ultimate_kronos_group_ransomware_attack/
[11] https://uk.trustpilot.com/review/www.parasolgroup.co.uk?stars=1
[12] https://www.linkedin.com/in/andrewfahey/detail/recent-activity/
[13] https://whitepapers.theregister.com/
As [1]reported by us on Friday , the umbrella company's MyParasol portal, where timesheets are submitted, was not accessible due to a multi-day outage starting on 12 January, impacting the processing of payroll.
Tech freelancers suspected a cyberattack was to blame for the blackout and sure enough the Group wrote to customers at the close of last working week to explain in more detail what had happened.
[2]
Doug Crawford, CEO at Parasol, said in an email to customers seen by us that the "root cause" of the issue affecting IT systems "has been identified as malicious activity on our network."
[3]
[4]
Crawford – who did not confirm the nature of the break-in, widely speculated to be ransomware – added: "The activity did not enter via the core Parasol platforms, but to ensure the safety and integrity of your data, we suspended our systems to protect the Parasol community. As you know, this included the MyParasol portal and our other outbound and inbound communication channels," he said in the email.
"The ongoing forensic exercise and investigations currently indicate that your personal information has not been extracted. We would of course have preferred to tell you more immediately about that exact circumstances of our system issues but were acting to preserve the integrity of the investigation."
[5]
An "experienced team" is still "working tirelessly to resolve this matter in a safe and controlled manner," Crawford added.
"Balancing speed versus safety is crucial in circumstances such as these. We have a strong dedicated IT, Security and Infrastructure team working around the clock, alongside our pre-existing security specialists."
Crawford conceded: "We know we are not providing our usual levels of support to you. Our system constraints are such that this has been impossible."
[6]
For freelancers wanting to contact Parasol, the CEO suggested using LiveChat, emailing via ES@Parasolgroup.co.uk or calling 01925 644 860.
The Register tried to email chief sales officer Greet Brosens last week and called the switchboard but the call didn't connect.
We rang the number above today and a connecting message stated Parasol Group was experiencing a high volume of calls. We called twice and it rang and rang for a combined 11 minutes with no answer, so readers may be in for a wait.
[7]Multi-day IT systems outage whacks umbrella biz Parasol Group amid fears of a cyber attack
[8]Searching for Skylab : Even the most casual astro-nerd will revel in this respectful elegy to unsung space history
[9]Campaigns propose new rules to protect contractors from rogue umbrella companies
[10]Timekeeping biz Kronos hit by ransomware and warns customers to engage biz continuity plans
Crawford said in the email it was "continuing to make same day payments" during the last weekend to pay umbrella workers as quickly as possible. Some freelancers don't appear to have been fully paid yet, and a bunch jumped on [11]Trustpilot this morning to voice their anger about the situation.
We have asked the UK's Information Commissioner to comment. ®
Attackers hit another umbrella firm
Umbrella outfit Brookson Group was also hit by a cyber attack last week, CEO Andrew Fahey revealed Friday 14 January on [12]LinkedIn.
Fahey said the company had taken steps to "disable all the Brookson services from accessing external networks."
Its tech team was working to restore services as promptly as possible, he added.
"Fortunately, our network defences spotted and contained the attack immediately and this allowed us to contain the impact and take the necessary preventative measures to ensure no data was removed."
Fahey said the "incident has been reported to the UK National Cyber Security Centre."
At the weekend, he said security folk were "combing" through its infrastructure, with a view to "ensur[ing] a safe removal of the cyber attack is completed as quickly as possible."
The business does not know when normal ops will resume.
Phone lines are not working, because the telephony system was IP-hosted, but email is. The Connect, Workforce Manager and IR35 portal are also disconnected.
Get our [13]Tech Resources
[1] https://www.theregister.com/2022/01/14/multiday_it_systems_outage_whacks/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeWgs0Wln5prDO1cuGlU2wAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/01/14/multiday_it_systems_outage_whacks/
[8] https://www.theregister.com/2019/03/29/searching_for_skylab_review/
[9] https://www.theregister.com/2021/05/17/campaigns_umbrella_firms/
[10] https://www.theregister.com/2021/12/13/ultimate_kronos_group_ransomware_attack/
[11] https://uk.trustpilot.com/review/www.parasolgroup.co.uk?stars=1
[12] https://www.linkedin.com/in/andrewfahey/detail/recent-activity/
[13] https://whitepapers.theregister.com/
Re: Mystery
Aristotles slow and dimwitted horse
Why so? I used one in the past and it was very useful in the short term as a quick and efficient way of having my contract payroll, tax and expenses calculated and paid correctly without the need for a full time accountant.
You're not just bashing because you are unable to comprehend that there is an increasing amount of people who need or want to work differently to you are you?
Re: Mystery
elsergiovolador
You are an employee of an umbrella, so this is their duty to do those things as any other employer's.
The problem is that these companies are being used as a tool to decouple de facto employer from their responsibilities coming from the employment law.
Re: Mystery
Little Mouse
If you're inside of IR35 and not planning on contracting for too long, then it's typically neither cost effective nor an efficient use of your time to set up your own company.
Also, every company I've contracted for has insisted that I am on someone's payroll (for liability reasons apparently - I've no idea if that's BS or not though). Being a sole trader simply wasn't an acceptable option to them.
Re: Mystery
elsergiovolador
insisted that I am on someone's payroll
Exactly, making a mockery of employment law.
Re: Mystery
Kubla Cant
If you're inside of IR35 and not planning on contracting for too long...
It seems to be immaterial whether you're contracting for a long or short time. Big clients all seem to be insisting on blanket IR35. Some run their own contractor PAYE via a captive agency, but most rely on umbrellas.
I seem to have had a lucky escape with Parasol. Was going to sign up with them, but the portal went down before I could agree the contract, so I've nominated another umbrella.
Mystery
It's a "mystery" why these companies even exist.