When PHP Hits The Fan: Responding to Cyber Attacks

Yesterday, one of our clients contacted us for assistance in relation a serious data breach with over 400,000 customer records affected.  This morning, we woke up to the news that this ‘PHP attack’ is not an isolated incident, with several government and business websites being temporarily shut down.  In this article we have set out some of the key points that business’ need to address when responding to cyber attacks and data breaches.

Lockdown and Rebuild

The number one priority is to fix the vulnerability that caused yours systems to be compromised, and ‘kick out’ any persons (or bots) with unauthorised access.  If that means turning off your systems completely to start with, so be it.  Lock down, contain and rebuild.

Cyber Insurance

Do you have it?  If so, make sure you notify your insurers immediately about the security breach.  Also, check the policy to see the scope of cover provided, and any limits, exceptions or exemptions that apply.  Knowing what is or might be covered, will help you to determine how best to manage the fallout of the incident.

If you don’t have cyber insurance, is it time to consider obtaining this going forwards?

Report to the ICO and NCSC

For UK companies, your data officer will need to consider whether you have an obligation to self-report the incident to the ICO, as per the Data Protection Act and GDPR.  If third parties have obtained customer data, this is inevitable.

You may also wish to consider reporting the incident to the National Cyber Security Centre and review their website for further guidance.

Investigate The Cause

Start with your own tech team, whether internal or external, to find out what caused the breach?  Did the compromise arise because:  (a) a member of staff foolishly clicked on an ‘obvious and suspicious’ link?, (b) outdated security software and protocols, or (c) a highly sophisticated cyber attack.  Essentially, has your company been negligent in any way?

Of course, take the first report with a ‘pinch of salt’, as your own tech team will understandably look to ‘self preservation’.  Ultimately, you may need an independent report from an external provider.  Potentially your insurers will cover the cost of such a report, albeit their motive might be to try and show that the cause was due to negligence rather than misfortune, should that mean ‘no payout is due’.

Notify Affected Parties

Again, your data officer will need to consider whether you have an obligation to notify clients, suppliers or other ‘third parties’ that a breach has occurred, and that their personal data has been compromised.  There may internal resistance to do so, but failing to comply with your obligations under the DPA and GDPR can have significant consequences.

Doing so may also limit the potential fallout later down the line, i.e. those affected should be given guidance as to any action they can take to avoid their data being used for fraud or other illegitimate purposes. 

Targeted Fraud & Monitoring

This will depend on the nature of your business, but you should anticipate how fraudsters may be able to make ‘good use’ of the stolen data.  For example, if a fraudster knows that David Zowie needs to pay a balance of £10,000 for his holiday to Japan before 01/02/26, David is more likely to be ‘duped’ into paying that money to an imposter masquerading as your company. 

Do not simply wave the white flag and wait for the worst to happen.  There may be practical steps that can be taken to intercept such activity.

Claims and Compensation

Take your time to assess the situation and liaise with your insurers before making any decisions.  Ultimately, however, there are two lines of defence here. 

First, you may be able to make the case that the breach did not arise as a result of any negligence on your part.  As above, this will come down to ‘expert evidence’.

Second, customers cannot assume they are entitled to compensation ‘on principle’.  The onus is on them to prove that they have suffered genuine loss/harm/distress. This has to be assessed on a ‘case by case’ basis.  One person may have had their private medical records shared with a  large group of travellers that they are currently travelling with, causing extreme embarrassment.  Another person may be a ‘stoic character’ and the data leaked may be limited to their name, historical address and inactive telephone number.

SAR Requests

Be prepared for customers affected asking you to delete their data.  However, do not panic and throw the ‘baby out with the bathwater’.  Follow your DPA/GDPR obligations as you would normally.  You may entitled to retain some categories of data and, indeed, you may need to retain some data in order to manage the fallout of the breach.

Get In Touch

If you are affected by any of the issues arising in this article, do not hesitate to get in touch with a member of the team at info@techlaw.co.uk