The year that saw Colin the Caterpillar get hacked - and what it teaches us

The cyberattacks on major UK retailers this year, such as Marks & Spencer and the Co-op, serve as a stark reminder of the evolving threat landscape.

When Colin the Caterpillar is impacted, you know things have got serious!

David Mulvey, our Digital Security Officer, shares his expert insights:

"The main headline has been Marks and Spencer, with the Co-op experiencing similar attacks (although thankfully with less severe repercussions). For both attacks, social engineering techniques were used to gain initial access to systems by impersonating support staff to deceive internal helpdesk workers, who then reset passwords and disabled multi-factor authentication for key accounts."

David emphasises two key lessons:

1️⃣ Don't underestimate the human risk element:

"Ask any cybersecurity professional what's the thing that keeps them awake at night? It's not quantum computing brute-forcing passwords - it's Steve in Accounts clicking on a phishing email and taking the whole network down. All users must be educated on what to look for and be prepared to question everything and everyone. With the advent of AI impersonation, you even need to be on guard with telephone and video calls."

2️⃣ Implement robust monitoring and incident response:

"Put in place monitoring systems for your IT systems alongside an awareness of those used by your suppliers, and be prepared to act decisively if you detect any suspicious activity. As part of our ISO 27001 accreditation, we've established a comprehensive security monitoring and management system; however, that by itself counts for nothing if we treat it as a mere checkbox exercise. We additionally perform tabletop exercises simulating security incidents, following our established procedures to firstly familiarise ourselves and also to see if they can be improved. And then repeat - again and again."

David wraps up with an important reminder:

"If it can happen to organisations as large as Marks and Spencer and the Co-op, it can happen to anyone - big or small. Recent reports have highlighted yet another ransomware attack, with social engineering again being the initial entry point - this time for Coca-Cola. All of which serves to remind us that in a world where cybercriminals exploit human error more than hacking tools, staying vigilant, practising good security hygiene (and ensuring your suppliers do the same) is your strongest defence."

If you need any help, or have questions about putting David's advice into action, we’d love you to get in touch; we’re happy to have a chat about working with you to strengthen your cybersecurity defences.

📷Colin the Caterpillar cake Marks & Spencer. Photograph: Publicity Image