A 2017 cyber attack has only just been settled. And it was the basics.
Currys has agreed to pay £200,000 to close the ICO's fine over malware on its tills, nine years after it started. The lessons are the same ones every business can act on this week.
What happened
Back in 2017, attackers got into the network at DSG Retail, the company behind Currys PC World and Dixons Travel, and installed malware on more than 5,000 tills. It ran for around nine months before it was found. By then it had exposed the details of about 5.6 million payment cards and personal information belonging to millions of customers.
In January 2020 the Information Commissioner's Office (ICO) fined the company £500,000, the most it could under the data protection law in force at the time. Then came years of appeals. A tribunal cut the fine, the Court of Appeal sided with the ICO in February this year, and on 8 October Currys agreed to pay £200,000 to settle the dispute, according to MLex.
So an attack that started nine years ago has only just been closed off. That's the bit I'd want every business owner to notice.
It wasn't a clever attack
The ICO's findings weren't about some unstoppable hacking group. They were about basics, including:
- Software that hadn't been kept up to date on systems that handled card payments.
- No local firewalls on those systems.
- A network that wasn't separated, so once someone was in, they could reach a lot.
- Not enough routine testing to spot weaknesses, or the attacker, sooner.
If those sound familiar, it's because they're most of what Cyber Essentials asks for: firewalls, secure settings, keeping software updated, and controlling who can get to what.
What this means for your business
The fine was capped at £500,000 because the breach happened under the old Data Protection Act. Under UK GDPR today, the ICO can fine up to £17.5 million or 4% of global turnover, whichever is higher. Most businesses never see fines anywhere near that, but the other costs are the same at any size:
- Time. Investigations, regulators, insurers and lawyers can run for years, not weeks.
- Customers. "We've written to let you know your details may have been affected" is a letter nobody wants to send.
- Contracts. More and more customers ask what you've got in place before they sign, and after a breach they ask harder.
And nine months undetected is the part that worries me most. Most businesses I look at couldn't say for certain whether someone had been in their systems for the last nine months.
Five things to check this week
- Find anything that hasn't been updated. Laptops, servers, the router, the card machine and any old PC that "just runs one thing". If it can't be updated any more, plan to replace it.
- Check your firewall is on and set up properly, on the router and on every laptop. The default settings are a start, not the finish.
- Separate the things that matter. Payment devices, cameras and guest Wi-Fi shouldn't sit on the same network as your files and accounts.
- Make sure someone would notice. Turn on sign-in alerts in Microsoft 365 or Google Workspace, and make sure security alerts go to a person who reads them.
- Work through the Cyber Essentials checklist, even if you're not certifying yet. It's the simplest list of basics there is, and it covers everything above.
If you'd like a quick outside view, run your domain through the free email security checker. And if you think someone may already be in your systems, treat it as a cyber incident.
Sources
Want to know where your basics stand?
I'll walk through the Cyber Essentials controls with you and tell you plainly what's fine and what needs fixing.