Reports state that a number of hackers have demanded millions from football club Manchester United after the team was hit by a ransomware attack.
The ransomware attack in question saw a number of Manchester United’s systems shut down to “contain the damage and protect data,” according to the club, with some reports stating that hackers have demanded millions from Manchester United after the ransomware attack.
To make things worse for the club, there is the potential of a large scale fine from the Information Commissioner’s Office for Manchester United if hackers have made their way into the personal information of club supporters. That is, in addition, to the pain caused by hackers’ demands for millions from Manchester United after the ransomware attack in question.
The UK’s National Cyber Security Centre – NCSC – has confirmed that it is working alongside Manchester United in the aftermath of the ransomware attack, with a spokesperson saying that “the NCSC is aware of an incident affecting Manchester United football club and we are working with the organisations and partners to understand the impact.”
Manchester United’s initial statement in response to hackers demanding millions from the football club, said that “following the recent cyber attack on the club, our IT team and external experts secured our networks and have conducted forensic investigations.”
“This attack was by nature disruptive, but we are not currently aware of any fan data being compromised,” it said.
“Critical systems required for matches to take place at Old Trafford remained secure and games have gone ahead as normal,” the statement said, adding that “the club will not be commenting on speculation regarding who may have been responsible for this attack or the motives behind it.”
Get Your Free ISO 27001 Gap Analysis Checklist
The Daily Mail is reporting that “Manchester United are being held to ransom for millions of pounds by cyber criminals who have crippled the club’s systems.”
The author of that report states that “it’s unclear who the criminals are or how much they want, but the NCSC revealed that in the last year an EFL club were hit with a £5m demand and the biggest single loss to a sports organisation from cyber crime was £4m.”
That same report makes reference to the potential fine from the Information Commissioner’s Office, who has in the past fined companies like British Airways in the aftermath of a data breach. Chris Wheeler writes that “United could also face fines of £9m, £18m or two per cent of their total annual worldwide turnover from the independent body Information Commissioner’s Office if the attack is found to have breached their fans’ data protection.”
The UK’s NCSC has in the past said that “the business impact of ransomware attacks can be disastrous,” adding that “since 2018, ranwomare attacks have been growing in impact. The criminals carrying out the attacks are taking more time to analyse victim networks and understand the ‘value’ of the target organisation.”
The cyber security agency adds that “using network analysis and lateral movement within the victim’s network, attackers try to ensure they have maximum impact on the victim organisation – potentially denying access to business-critical files and systems.”
Jon Niccols, a cyber security analyst with Check Point has told InfoSecurity Magazine that “it isn’t clear what type of attack hit the club, but as its statement mentioned that it ‘shut down affected systems to contain the damage and protect data,’ this suggests ransomware, and possibly a double extortion attack where attackers both steal data with the threat of leaking it, as well as encryption it to disrupt operations.”
That same report quotes Adam Enterkin of BlackBerry who said that “the exploitation of sporting giants by cyber criminals is not a surprise. Amid a pandemic characterized by opportunistic cyber-attackers, and a huge deficit of security professionals in the UK, such an attack was all but inevitable.”
“Manchester United isn’t the first to be hacked, and it won’t be the last,” Enterkin said.
“These attacks are, however, preventable. The truth is that the entire nation needs better cyber-hygiene. Even national institutions like sports teams can fall prey to simple phishing emails, which are responsible for a large proportion of cyber-attacks. Cyber-criminals are waiting for organisations and the public to drop their guard.”
“We must not give them the opportunity,” he concluded.
