Sensitive details of serving police officers within at least one British force have been stolen after an attack on one of their suppliers.
The supplier, who provide ID badges, was targeted in an attack. Stolen details include the names, photos and identity numbers of officers.
This attack once again highlights how serious the implications can be when data breaches occur within suppliers. In this case, there are concerns that the identities of undercover officers could be revealed.
As with other supply chain incidents, the end organisation (in this case, at least one police force) was not breached themselves. British police forces adhere to a very high level of security meaning that they are not an attractive direct target for threat actors.
Suppliers remain a black hole of security risk
Although many organisations have an understanding of their own security levels, the same cannot be said for their suppliers. Only 13% of British businesses track cyber risks among their supply chain (UK Government statistic) and even then, it is primarily through self-attestation in the form of questionnaires.
This means that even among companies who do attempt to measure their third party cyber risk levels, they are heavily reliant upon suppliers to be aware and honest. Crucially, this doesn’t just rely upon the organisation’s level of awareness but on the awareness of the person completing the form.
Without possessing a true picture of cyber risk levels, organisations have no measure of their risk exposure.
Measure cyber risks among your suppliers for free
Measuring and managing cyber risks among your suppliers doesn't need to be a slow, manual process. Click here to try the Darkbeam platform for free.
Any data is valuable to attackers
This cyber attack and subsequent data breach has caused concern for the safety of employees within at least one British police force. It is one of several attacks in recent times to expose personal details of organisations’ employees.
Another recent high profile attack was against the MOVEit platform in June. The platform was used by suppliers - including a popular HR and Payroll platform. It exposed personal details including addresses and national insurance numbers of employees as organisations including the BBC, two airlines, a national retailer, a university and others.
Information about people (employees and customers) is valuable to attackers because it can be used in acts of fraud. Targeting suppliers who hold this information is often more effective than targeting the organisation themselves. Partly because suppliers have several clients (so store details of more people) and partly because they are often less secure than their larger clients.
Personal details of people is not the only kind of information that threat actors target. Earlier this month (September 2023), a Russian-speaking group called LockBit targeted the supplier of fences to Britain’s nuclear submarine base and several prisons. This breach caused a degree of security concerns and a significant amount of negative media coverage.
Make cyber risk manageable for Procurement teams
Cyber risks among suppliers should be seen as a critical business risk to manage. For Procurement teams, this can be an intimidating task - with the perception that measuring and managing these risks will be time-consuming and require specialist skills.
Supplier cyber risks can be measured and controlled
Despite the perception of cybersecurity risks being complicated, time-consuming and expensive to assess; it is very possible to gain a quick understanding of third-party cyber risk levels.
Darkbeam makes this possible by automating the vulnerability assessment process of every supplier in a supply chain and continuously monitoring for threats against and data breaches from any supplier with access to sensitive information.
Try Darkbeam’s platform for free or fill in the form below to speak to a member of our team. We will show how managing cyber risk among suppliers is fast, efficient, affordable and scalable - all within a simple platform which takes less than an hour to onboard.