James McGachie

These risks were highlighted in last week’s Auditor General for Scotland report concerning the cyberattack suffered by the Scottish Environment Protection Agency (Sepa) on Christmas Eve in 2020. Employees and customers were unable to access Sepa’s systems and data because malicious software had been installed after an adversary gained access. The ransom was not paid, and the majority of Sepa’s data remained encrypted, stolen or lost.

The impact upon Sepa’s data meant that accounting records had to be recreated from bank statements and HMRC records, leaving auditors unable to fully examine Sepa’s finances, including £42 million of contract income.

While independent analysis found that Sepa had a high level of cyber maturity, the Auditor General noted that Sepa’s business continuity plans and incident response playbooks could not be accessed after the attack. Given only a limited number of personnel could access hard copies due to Covid restrictions, had staff not been familiar with its continuity plans and processes, Sepa’s response may have been hindered.

Incidents of this nature demonstrate the need to ensure that cyber resilience is regularly rehearsed, reviewed and “health checked” in any organisation, with internal response plans tested and audited by way of routine fire drills undertaken on a regular basis. Having retained and trusted advisers in any incident management plan – including forensic, legal, and public relations expertise – assists in preparing an early response to any incident. Such action also assists in ensuring that any cyber insurance policy in place can be relied upon.

Many ransomware criminals undertake “double extortion” – whereby data may not only be encrypted but also stolen and published on the internet if a ransom demand is not met. The associated commercial risks of such actions, together with the potential risks where personal data is implicated – both in terms of regulatory intervention by the ICO and claims from impacted data subjects – mean that being able to demonstrate robust resilience as a means of mitigation is critical.

While the original source of the Sepa attack remains unknown, human error in responding to a “phishing” e-mail – where an attacker, masquerading as a trusted contact, convinces a victim to open a message containing malicious content or to hand over login credentials – is considered the likely source of the incident. Regular refresher training and implementation of multi-factor authentication – where a digital token is required along with a user password to successfully login – provides a safety net against such attempts.

Sepa’s experience highlights the difficulties in defending against the threat of sophisticated cyberattacks – but being able to demonstrate preparedness where such incidents do arise is essential in the current climate.

James McGachie is a legal director in DLA Piper’s litigation and regulatory practice. This article was first published in The Herald.