Ransomware attacks are becoming increasingly prevalent. While recent headlines may have highlighted ‘big business’ being attacked, cyber criminals are indiscriminate in the size of organisation they target.
Opinion
Don’t get held to ransom over safety data
By
on 23 August 2021
Ransomware attacks occur when cyber criminals gain access to an IT system, often through a ‘back door’ or simply by someone clicking on a phishing link in an email. They navigate through the system, infecting it with malware, before striking and encrypting the entire system. This can paralyse a business unless adequate backups are in place. Not only is business continuity affected, but the information on the IT system can be exploited.
Recent experience shows that the cyber criminals can drip feed ‘proof of life’, showing the victim organisation what information they have taken from the IT systems. Cyber criminals recognise that personal data is a valuable asset.
The legal consequences
Data protection legislation requires any ‘data controller’ affected by a personal data breach to notify the ICO (Independent Commissioner’s Office) within 72 hours of becoming aware of it, unless it is unlikely to affect the rights and freedoms of the people concerned. Failure to do so could result in fines being imposed. However, if the breach results in a ‘high’ risk to the individuals, they also need to be told about it directly, without undue delay.
Laura Gillespie is a partner in the Pinsent Masons’ Litigation and Regulatory Compliance team, specialising in data privacy and cyber security matters.
Health and safety professionals often hold sensitive or ‘special category’ information, given the nature of their roles. If very sensitive information ends up in the hands of a cyber criminal, this could increase the risk to the individual – either because of the risk of socially-engineered identity fraud or the loss of very sensitive and confidential medical information.
As such, there can be a greater risk that information held by health and safety professionals could trigger the ‘high risk’ threshold if it gets into the hands of a cyber criminal.
People affected by data breaches have the right to claim compensation. The Supreme Court is currently considering the extent of that right in the case of Lloyd v Google LLC, but it is clear that if a ransomware attack occurs, the cost to the affected business may not just be business continuity, reputation or regulatory fines, but also claims for compensation.
How to protect against ransomware
As with any compliance programme, prevention is the best form of protection. Ensuring that regular reviews of IT ‘patches’ and security updates are run is crucial, along with back-ups which have been tested. Implementing multi-factor authentication can be another useful way to add an extra layer of protection and organisations should seek to ensure that any very sensitive information is sufficiently segregated and encrypted on the system.
Incident response plans will be key but if they are stored on encrypted IT systems they may be inaccessible. Pinsent Masons has devised Cyturion, which is a remotely-hosted cyber response tool. This provides a tailored response process and is accessible from anywhere, even when systems are unavailable.
Laura Gillespie is a partner in the Pinsent Masons’ Litigation and Regulatory Compliance team, specialising in data privacy and cyber security matters.
For guidance on the UK General Data Protection Regulation (UK GDPR) see: ico.org.uk/for-organisations
OPINION
In these times, how can we be safe, well and happy?
By Mike Robinson FCA on 01 July 2024
Last month, I mentioned two big moments – the General Election and the 50th anniversary of the Health and Safety at Work Act (1974) on 31 July. The lack of attention given to health, safety, or even wellbeing by most political parties in their election manifestos, while not entirely unexpected, was disappointing. And it doesn’t reflect the real concerns of workers and leaders here and around the world.
It’s time to protect all leaseholders from ruinous building safety remediation costs
By The Earl of Lytton on 28 June 2024
In my previous piece for Safety Management last summer (‘A new Building Safety Remediation Scheme would hold developers and builders to account for all fire and building safety defects in homes’) I set the scene on the unfolding world of building safety remediation and described how I was attempting to change things in the interests of consumer safety. Now with a general election called, there is an opportunity to influence the policies of a new, incoming administration.
Menopause at work: government failing to grasp benefits of providing more support to women workers
By Caroline Nokes on 01 May 2023
Many employers are waking up to the realities of menopause, and the benefits of providing a supportive environment for women at work. CIPD (Chartered Institute of Personnel and Development) research shows that 30 per cent of UK employers now have menopause policies, up from 10 per cent in 2019. But I am increasingly worried that the government has not appreciated the need to seize momentum.