Company fined £60k after cyber attack
According to the ICO, this failure enabled cyber hackers to gain access to DPP's network, via an infrequently used administrator account which lacked multi-factor authentication (MFA), and steal large volumes of data.
This occurred in June 2022 when DPP suffered a cyber attack which affected access to the firm's IT systems for over a week. A third-party consulting firm established that a brute force attempt gained access to an administrator account that was used to access a legacy case management system.
READ MORE: 'Stunning' new build in 'highly sought-after' coastal location
READ MORE: How often you should bath your kids and is daily bathing too much
This enabled cyber attackers to move laterally across DPP's network and take over 32GB of data, a fact DPP only became aware of when the National Crime Agency contacted the firm to advise information relating to its clients had been posted on the dark web.
The ICO said DPP did not consider that the loss of access to personal information constituted a personal data breach. As a result, it did not report the incident to the ICO until 43 days after it became aware of it.
Andy Curry, ICO interim director of enforcement and investigations, said: "Our investigation revealed lapses in DPP's security practices that left information vulnerable to unauthorised access.
"In publicising the errors which led to this cyber attack, we are once again highlighting the need for all organisations to continually assess their cybersecurity frameworks and act responsibly in putting in place robust measures to prevent similar incidents.
"Our investigation demonstrates we will hold organisations to account for a failure to notify where there was a clear obligation to do so at the time of the underlying incident.
"Data protection is not optional. It is a legal obligation, and this penalty should serve as a clear message: failure to protect the information people entrust to you carries serious monetary and reputational consequences."
DPP specialises in law relating to crime, military, family fraud, sexual offences and actions against the police. An ICO statement said: "The very nature of this work means it is responsible for both highly sensitive and special category data, including legally privileged information.
"As the information stolen by the attackers revealed private details about identifiable individuals, DPP has a responsibility under the law to ensure it is properly protected."
The law requires organisations to take continual and proactive steps to protect themselves against cyber attacks. This includes ensuring all IT systems have MFA or equivalent protection, regularly scanning for vulnerabilities and installing the latest security patches without delay.
The ECHO has approached DPP for comment.
For the latest news and breaking news visit http://www.liverpoolecho.co.uk/news/. Get all the big headlines, pictures, analysis, opinion and video on the stories that matter to you.
Join the Liverpool ECHO Breaking News and Top Stories WhatsApp community to receive the latest news straight to your phone by clicking here.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
4 days ago
- Yahoo
Update in bid to jail Taser cop
A policeman who avoided jail after fatally tasering a nursing home resident could be handed a harsher sentence as soon as next week. Senior Constable Kristian White, now 35, was found guilty of manslaughter of 95-year-old Clare Nowland after he was called to Yallambee Lodge nursing home in Cooma in the state's south on May 17, 2023. White was sentenced to a two-year community order and 425 hours of community service, but the Office of the Director of Public Prosecutions is appealing the sentence. The judgment will be given on July 30. Mrs Nowland was described as being a 'very aggressive' resident who was holding two knives by a nurse, but was holding only one knife and a penlight when White found her sitting in an office after 5am. He repeatedly told her to drop the blade during a confrontation that lasted less than three minutes. When she failed to drop it, White said 'bugger it' before tasering her: Ms Nowland died in hospital days later. White was found guilty of Mrs Nowland's manslaughter in November last year following a NSW Supreme Court trial. White is expected to learn whether prosecutors were successful in their bid to impose a harsher sentence on him, with the matter listed for judgment in the NSW Court of Criminal Appeal (CCA). Cop didn't give Ms Nowland 'any real chance' The DPP's case hinges on four grounds of appeal, including the sentencing judge made several errors by assuming both parties agreed White honestly believed his conduct was necessary, in his assessment of objective seriousness, and in finding that general deterrence had 'little or no role' or only a 'minor' role to play in White's sentence. The sentence is 'manifestly inadequate', the final ground claims. Crown Prosecutor Sally Dowling SC last month argued White did not give Ms Nowland – clearly vulnerable and disoriented – any 'real chance to avoid being tasered'. Footage of the fatal incident made it clear Ms Nowland didn't understand or hear White's instructions, Ms Dowling told a CCA hearing. 'The respondent did not give her any real chance to avoid being tasered,' Ms Dowling said. '(There were) many alternate actions that he could have and should have taken.' Ms Nowland didn't advance towards White at any point, and needed to hold onto her walker with both hands, Ms Dowling said, which all fell under the Crown's appeal of objective seriousness. She told the court it took White less than three minutes after first seeing Mrs Nowland to deploy his taser, which caused her to immediately fall and hit her head. 'She never regained consciousness after that fall, and that injury caused her death seven days later,' Ms Dowling said. White's lawyer, Troy Edwards SC, rejected the Crown's claims that Mrs Nowland posed no threat, arguing it was inconsistent with observations of the sentencing judge and witnesses. He also urged the court not to place emphasis on footage from the incident, but to rely on the accounts of witnesses who he said felt frightened as the incident unfolded.
Yahoo
03-07-2025
- Yahoo
Conor McGregor sexual assault lawsuit appeal material now the subject of a perjury probe
Former UFC champion Conor McGregor was found liable for a sexual assault in Ireland in 2024. The Court of Appeal in Ireland has referred withdrawn evidence from Conor McGregor's civil case appeal to the Director of Public Prosecutions (DPP), with accuser Nikita Hand's team citing potential perjury. Hand successfully sued the MMA star this past November after claiming he had raped her in a Dublin hotel in December 2018. Advertisement McGregor's appeal process began Tuesday morning in Dublin. When proceedings got underway, McGregor's legal team declared that the evidence provided in affidavits by former neighbors of Hand's, Samantha O'Reilly and Stevens Cummins, would be withdrawn as a ground for appeal. In a sworn — now withdrawn — statement, O'Reilly claimed that she saw Hand's then partner Stephen Redmond assaulting her within the same timeframe that the assault by McGregor was alleged to have taken place. Quotes published by Sunday World in May stated that O'Reilly claimed she saw an assault take place from her bedroom window. She claimed to have seen Redmond push Hand to the ground, but did not see him strike any blows, as her view was obscured. 'I could see [Redmond's] arms moving up and down as if he was hitting Nikita. I also saw him moving his hips in a way that indicated to me that he was kicking her,' said O'Reilly, according to the Sunday World. Advertisement Her partner, Cummins, claimed he heard screams from Hand's home around the same time. In a counter affidavit, Hand described the claims of O'Reilly and Cummins as 'lies' and insisted that Redmond had never assaulted her. Both O'Reilly and Cummins came forward with their information only after McGregor lost the civil trial, for which Hand was awarded approximately €250,000 in damages. McGregor denied raping Hand, insisting they had consensual and 'vigorous' sex. Perjury John Gordan, senior counsel for Hand, asked the Court of Appeal to use its powers to refer matters to the DPP, citing concerns around perjury. The three judges of the court — Justice Isobel Kennedy, Justice Brian O'Moore and Justice Patrick MacGrath — said they would do so. Advertisement Gordon said it was 'frankly not appropriate' for the ground to be withdrawn at a late basis. He revealed that he had been made aware of the withdrawal 10 minutes before it was announced in court and argued that he should be allowed to cross-examine O'Reilly and Cummins. Gordon noted that the application regarding the affidavits had been submitted 'some months ago,' and that the information the proposed witnesses intended to present had been 'widely published' within Irish media. He reminded the court of the 'scale of the accusations' directed at his client, describing them as a series of 'highly disparaging and unfair criticisms,' including allegations that she had been dishonest. According to the Irish Times, along with the perjury concerns Gordan cited with regard to O'Reilly and Cummins' statements, he also cited concerns that McGregor may have induced perjury. Advertisement However, a spokesperson for McGregor told The Irish Mirror Thursday that he was not subject to referral to the DPP, meaning that he is not currently being investigated. Appeal The Court of Appeal has said it will give judgment 'in due course' on McGregor's appeal against the civil jury's November finding, according to a Thursday report from the Irish Times. Despite the evidence from O'Reilly and Cummins being withdrawn, McGregor's legal team advanced other grounds for appeal. One ground included that the trial judge, Justice Alexander Owens, erred in directing that the High Court civil jury should be asked to decide whether McGregor assaulted, rather than sexually assaulted, Hand. Advertisement Another ground included that the trial judge erred in permitting a line of questioning concerning McGregor's 'no comment' responses to investigating gardaí (Irish police) after providing them with a pre-prepared statement in response to Hand's rape claim. Lawyers for Hand opposed the appeal and urged the court to allow the jury decision to stand. An order requiring McGregor to pay Hand's estimated €1.3m legal costs has been stayed pending the outcome of the appeal.
Business Insider
28-06-2025
- Business Insider
A notorious hacker group is now targeting the aviation industry, the FBI says
Even IT pros are susceptible to hackers these days. According to an FBI warning, a notorious cybercriminal group known as Scattered Spider is deceiving IT help desks into targeting the US airline industry. Scattered Spider gained attention in 2023 for hacking both MGM Resorts and Caesars Entertainment within a week of each other. "These actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access," the FBI said on X. "These techniques frequently involve methods to bypass multi-factor authentication (MFA), such as convincing help desk services to add unauthorized MFA devices to compromised accounts." The FBI said the group is focused on large corporations and their third-party IT providers, so "anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk." "Once inside, Scattered Spider actors steal sensitive data for extortion and often deploy ransomware," the agency said. The FBI did not indicate that the actions affect airline safety. Charles Carmakal, the chief technology officer at Google's Mandiant, a cybersecurity firm and subsidiary of Google Cloud, said on LinkedIn that the firm was "aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider." "We recommend that the industry immediately take steps to tighten up their help desk identity verification processes prior to adding new phone numbers to employee/contractor accounts (which can be used by the threat actor to perform self-service password resets), reset passwords, add devices to MFA solutions, or provide employee information (e.g. employee IDs) that could be used for a subsequent social engineering attacks," he said. Unit 42, a cybersecurity threat research team that is part of the larger Palo Alto Networks cybersecurity corporation, said it also observed Scattered Spider targeting the aviation industry. "Organizations should be on high alert for sophisticated and targeted social engineering attacks and suspicious MFA reset requests," Sam Rubin, senior vice president of consulting and threat intelligence for Unit 42, said on LinkedIn on Friday. Canada's WestJet announced earlier this month that it had uncovered a "cybersecurity incident involving internal systems and the WestJet app, which has restricted access for several users." A spokesperson told Business Insider the company has made "significant progress" regarding the matter, and investigations were ongoing. Hawaiian Airlines also said on Thursday that it experienced a "cybersecurity event" that affected some of its IT systems. "We continue to safely operate our full flight schedule, and guest travel is not impacted," the company said in a press release. Neither airline provided details about who or what caused the cybersecurity incidents. A Southwest Airlines spokesperson said that its systems had not been compromised.
