Details of the incident
On 19 October 2022 the ICO fined Interserve Group Limited (Interserve) £4.4 million in relation to contraventions of Article 5(1)(f) and Article 32 of the GDPR which occurred between 18 March 2019 and 1 December 2020.
On 30 March 2020 a phishing email was sent to Interserve’s accounts team with an urgent request to review a document. The email and attachment were opened by an employee and downloaded onto their workstation, which executed the installation of malware, giving the hacker access to the employee’s workstation.
When this incident was discovered, Interserve’s team took steps to remove some of the files, but did not verify that all of the malware had been removed. Malware remained on the employee’s workstation and over the next month the attacker was able to compromise almost 300 systems and uninstall Interserve’s antivirus protection. The hacker encrypted data on the systems and rendered it unavailable to Interserve.
This further incident was discovered during a maintenance check on 2 May 2020 at which point Interserve notified the National Cyber Security Centre of the incident.
In total, over 113,000 employees’ data were compromised. The data included information such as contact details, national insurance number and bank details as well as special category data such as health information, gender, sexual orientation and disability information.
ICO findings
The ICO identified a raft of failings on Interserve’s part in relation to information security. These included:
- Basic failures to keep systems up to date, to use standard protections like operating the latest antivirus protection and using out of date protocols;
- Failure to undertake appropriate vulnerability scanning and penetration testing;
- Failure to provide appropriate data protection training for its employees;
- Failings in the initial investigation of the incident;
- Failure to properly manage access permissions; and
- Failure to restore data in a timely manner.
It is worth noting that Interserve had information security policies in place, but these were not adhered to.
The ICO decision gives an interesting walk through of aggravating and mitigating factors which influenced the amount of the fine. The starting point for the fine was set at £4 million – a reduction to £3.5m was made for the remedial steps taken (despite earlier failures in this regard). The failure to observe its own policies and procedures and the fact some of the failings were basic security issues which could have been fixed without significant cost and failure to take account of publicly available guidance boosted the fine to £4.5 million. Co-operation with the ICO saw a reduction to £4.4 million. The rest of the factors explored had a neutral effect.
Information security and cyber security in particular are topics which have been receiving a lot of press at the moment. Please see below for our top tips on improving cyber security compliance in your organisation.
Top tips on improving cyber security
Cyber security continues to be a hot topic for all organisations. As demonstrated by the ENISA report, the landscape is evolving, and attackers are becoming more sophisticated. As such, it is vital to ensure cyber security is a central part of your compliance programme. The following (although not an exhaustive list) are some top tips on improving your approach to cyber security.
- Consider where the main threats to your cyber security lie and consider how effective the measures you have in place are at addressing them. Those responsible for data protection within an organisation should be satisfied these issues are being addressed even if another team is technically responsible.
- Ensure you have appropriate policies and procedures in place and that there is clear ownership of the responsibilities contained in them. A major failing in the Interserve case was the lack of compliance with their own policies. These policies and procedures must be reviewed on a regular basis to ensure they are fit for purpose.
- Ensure your systems and cyber security protections are up to date and that your employees are taking steps to complete any updates they need to undertake personally. This is basic, yet it was overlooked by Interserve. Out of date systems and software may no longer receive security updates, creating vulnerabilities which can be exploited. Regular testing will also be necessary to ensure systems/protections are behaving correctly.
- Ensure your employees are properly trained. As identified in the ENISA threat report, the most common way in which hackers gain access in ransomware attacks is via phishing. Consider which teams are most at risk of such an attack and ensure you are undertaking regular and specific training about how to spot a phishing email. You should also offer training more broadly on information security.
- Ensure your processes for onboarding and ongoing management of third-party suppliers are fit for purpose. As the ENISA report identified, cyber attackers are increasingly exploiting weaknesses in supply chains in order to get access to a bigger target. Conducting a proper review of your suppliers’ data protection and information security practices when considering whether to onboard a supplier and having an ongoing programme to review this can be a way of reducing these risks.
- Check your permissions. Access permissions should be the subject of policies and procedures. Where these are in place, check they are being applied correctly. One of the issues in the Interserve case was the wide permissions granted to employees which, in some cases, included the ability of some individuals to uninstall antivirus protection – this was exploited by the hackers.
- Ensure your incident response procedures are robust. Whilst you may not always be able to prevent unauthorised access to your systems, you can control your response and so potentially the damage done by any incident.
- Keep up to date with threats in order to identify any new training needs for your organisation.
