My name is Lisa Ventura MBE, and I’m delighted to be asked by TDP to provide an update and round-up of all thing’s cybersecurity from March to September 2024.
In this latest update we aim to provide you with a comprehensive overview of recent cybersecurity news including notable data breaches, emerging threats, and trends in cybercrime. Our goal is to equip you with the knowledge and insights needed to better protect yourself and your organisation against cyberattacks.
From large-scale breaches affecting multinational corporations to targeted attacks on small businesses and individuals, the cyber threat landscape is diverse and constantly evolving. By staying informed and understanding the tactics employed by cybercriminals, you can take a proactive approach to safeguarding your digital assets and mitigating the risk of falling victim to a cyberattack.
Notable Data Breaches – March to September 2024
During the first quarter of 2024, several notable data breaches shook the cybersecurity landscape. These affected organisations across various sectors, and here are some of the more prominent incidents which highlight the growing threat to sensitive data:
- Harvey Nichols (September 2024): The luxury department store suffered a data breach attributed to a system vulnerability, exposing customer data such as names, email addresses, phone numbers, and home addresses. While no financial information was leaked, Harvey Nichols warned customers about the potential for phishing attacks. The company has since patched the vulnerability and implemented regular security scans to prevent future breaches.
- Transport for London (September 2024): On September 1, 2024, TfL discovered unauthorized access to customer and staff data. This significant cyberattack affected their IT systems, although the full scope of the compromised data has not been publicly disclosed. The incident underscores the risks faced by public service organizations.
- The Billericay School (May 2024): This Essex-based school experienced a critical cyberattack during the half-term break, compromising sensitive information of students, staff, and parents, including names, addresses, and medical notes. The breach led to the temporary closure of the school, highlighting the increasing vulnerability of the education sector.
- NHS and Synnovis Laboratory (June 2024): Synnovis, a pathology laboratory serving multiple NHS organizations, was hit by a ransomware attack. Sensitive patient information was stolen, and the attack disrupted blood testing services in Southeast London, causing delays in medical appointments.
In addition to these, while not strictly speaking a cyberattack, the CrowdStrike outage that occurred highlighted the potential for what could happen if a cyberattack took down all the elements that make up the critical national infrastructure (CNI).
This significant global outage happened in July 2024 after a faulty update to its Falcon Sensor security software. The update, which was meant to enhance security on Microsoft Windows systems, instead caused widespread disruptions. Many Windows computers running the software began crashing and could not restart properly, leading to service interruptions across multiple sectors, including healthcare, transportation, and financial services. As a result, critical operations were affected, with some organizations unable to access essential data, such as test results and appointment information in the UK’s National Health Service (NHS).
The global scale of the outage was unprecedented, with approximately 8.5 million devices impacted worldwide. CrowdStrike immediately acknowledged the issue, and teams worked rapidly to develop and deploy a corrective update. Despite the swift response, the outage raised concerns about the reliability of large-scale security updates and the potential fallout from technical errors in mission-critical software. The incident resulted in widespread disruptions, and organizations affected had to navigate not only the technical fallout but also operational delays that spanned several days
If you liked this content…
Police Scotland Hit by Multiple Data Breaches Involving Sensitive Personal Information
Third-Party Threats: The Supply Chain Risk You Can’t Afford to Ignore
The Ticking Clock on Windows 10: Public Sector at Risk
Protecting critical networks: Supply chain security in the utilities sector
Think Digital Identity and Cybersecurity for Government: Key Takeaways
These incidents and breaches illustrate the varied nature of cyberattacks in the UK, affecting sectors from healthcare and education to retail and public transportation, reinforcing the need for stronger cybersecurity measures across all industries. Organisations of all sizes should remain vigilant and proactive in safeguarding their data against evolving cyber threats to maintain the trust and confidence of their customers.
Government Cybersecurity News and Initiatives
The UK government continues to make cybersecurity a huge priority along with AI, and work to deliver the five pillars that are outlined in the National Cybersecurity Strategy that was launched in January 2022. The Department for Science, Innovation and Technology (DSIT) also continues to drive technology forward in the UK.
Between March and September 2024, the UK Government has made significant strides to bolster its cybersecurity landscape in response to the increasing number of cyberattacks targeting critical infrastructure and public services. One of the most notable initiatives was the announcement of the Cybersecurity and Resilience Bill during the King’s Speech in July 2024. This bill aims to strengthen the country’s cyber defences by expanding the scope of existing regulations, such as the Network and Information Systems (NIS) Regulations 2018, to cover more digital services and supply chains. It also provides regulators with enhanced powers to enforce cyber safety measures and investigate potential vulnerabilities.
Additionally, the bill will mandate the reporting of ransomware attacks, improving government oversight and data on cyber threats, ensuring better protection for the UK’s economy and critical infrastructure (such as transport, healthcare, and energy) against evolving cyber threats.
In conjunction with this bill, the UK Government has also emphasised the need to modernize its regulatory framework to stay aligned with international cybersecurity standards, such as the EU’s NIS2 directive. Beyond regulation, the government has committed substantial investments into cybersecurity, including a £2.6 billion allocation through the National Cyber Strategy, which focuses on improving resilience across all sectors.
This period also saw the National Cybersecurity Centre (NCSC) issuing advisories, particularly around state-sponsored threats, such as those from China, to help organizations safeguard their operations from sophisticated attacks. These efforts demonstrate the government’s proactive stance in addressing the rapidly evolving cyber threat landscape.
The UK also convened leading nations including the US and EU for talks on how to tackle the growing threat of cyberattacks, as new figures showed nearly half of British businesses do not have the skills needed to protect against cyber-crime.
It took place at Wilton Park in West Sussex, and the discussions come at a critical time following recent high-profile incidents – including the global IT outage from CrowdStrike, they cyberattack that impacted NHS service providers, and attempts to disrupt London’s transport network via the TFL cyberattack.
Over three days countries including the EU member states, Canada, Japan and international organisations such as the World Economic Forum (WEF) and the Organisation for Economic Co-operation and Development (OECD) discussed how global cybersecurity workforces can be strengthened, from agreeing ways to boost cyber skills to developing new professional standards.
Attendees to Think Digital Identity and Cybersecurity for Government on Thursday 24 October 2024 will be able to find out much more about the latest initiatives and updates in cybersecurity from a UK government perspective.
Final Thoughts
The time period from March 2024 to September 2024 has seen significant developments in cybersecurity. From emerging threats to new regulations, the number of threats is evolving rapidly, and the need to respond to those threats remains as crucial as ever.
I’m looking forward to attending and participating in a panel discussion at Think Digital Identify and Cybersecurity for Government this month, but I am always happy to talk to anyone before then. Please feel free to email me via lisa@csu.org.uk, or find me on LinkedIn, and let’s continue the conversation.
