By James McGachie

RANSOMWARE – malicious software used by criminals to encrypt information until a ransom is paid – poses a growing danger to both private and public sector organisations. With the National Cyber Security Centre indicating that three times as many ransomware attacks took place in the first quarter of 2021 than in the whole of 2019, the threat is increasingly acute, with cyber resilience now a key priority in boardrooms.

These risks were highlighted in last week’s Auditor General for Scotland report concerning the cyberattack suffered by the Scottish Environment Protection Agency (Sepa) on Christmas Eve, 2020. Employees and customers were unable to access Sepa’s systems and data because malicious software had been installed after an adversary gained access. The ransom was not paid, and the majority of Sepa’s data remained encrypted, stolen or lost.

The impact upon Sepa’s data meant that accounting records had to be recreated from bank statements and HMRC records, leaving auditors unable to fully examine Sepa's finances, including £42 million of contract income.

Whilst independent analysis found that Sepa had a high level of cyber maturity, the Auditor General noted that Sepa’s business continuity plans and incident response playbooks could not be accessed after the attack. Given only a limited number of personnel could access hard copies due to Covid restrictions, had staff not been familiar with its continuity plans and processes, Sepa’s response may have been hindered.

Incidents of this nature demonstrate the need to ensure that cyber resilience is regularly rehearsed, reviewed and “health checked” in any organisation, with internal response plans tested and audited by way of routine fire drills undertaken on a regular basis. Having retained and trusted advisors in any incident management plan – including forensic, legal, and public relations expertise – assists in preparing an early response to any incident. Such action also assists in ensuring that any cyber insurance policy in place can be relied upon.

Many ransomware criminals undertake “double extortion” – whereby data may not only be encrypted but also stolen and published on the internet if a ransom demand is not met. The associated commercial risks of such actions, together with the potential risks where personal data is implicated – both in terms of regulatory intervention by the ICO and claims from impacted data subjects – means that being able to demonstrate robust resilience as a means of mitigation is critical.

Whilst the original source of the Sepa attack remains unknown, human error in responding to a “phishing” e-mail – where an attacker, masquerading as a trusted contact, convinces a victim to open a message containing malicious content or to hand over login credentials – is considered the likely source of the incident. Regular refresher training and implementation of multi-factor authentication – where a digital token is required along with a user password to successfully login – provides a safety net against such attempts.

Sepa’s experience highlights the difficulties in defending against the threat of sophisticated cyberattacks – but being able to demonstrate preparedness where such incidents do arise is essential in the current climate.

James McGachie is a legal director in DLA Piper’s litigation and regulatory practice, based in Scotland.