Menu
Simplify, a conveyancing law firm, was a victim of a targeted cyber attack at the back end of 2021.
The company was hacked and access to their IT and telephone systems was lost, leaving thousands of customers unable to complete on their property purchases. It is believed the attack subsequently caused outages at five law firms within the Simplify group, multiplying the issues.
Delays and costs affected distressed buyers and sellers throughout the chain. Frustrated and worried customers, unable to complete their house purchases and faced with a lack of information from the business, voiced their discontent on social media.
There have been many interesting developments since the incident, a few of which particularly caught our eye. The first was a call from MPs for an official investigation into the cyber attack against Simplify Group. They called for “an official inquiry and ‘some sort of compensation’ should be issued to customers over the attack”, demonstrating the significance of the damage caused and potentially further damaging the firm’s reputation.
The second was an alert from The Guild of Property Professionals, who warned estate agents that “more and more reports are being filed about cyber attacks on agencies themselves or on companies whose work impacts on the house sales industry.” This suggests cyber criminals are specifically targeting UK business sectors with tactics which seem to be working against similar firms. At the same time, we know that cyber criminals often use an opportunistic approach to compromising businesses, meaning firms have to look out for both targeted and untargeted attacks.
Lastly, The Council for Licensed Conveyancers made a statement on Simplify’s incident. They stated what happened to Simplify could have happened to any business and the attack ‘served a very harsh lesson to all’. The council also suggested more attacks are likely to hit conveyancer firms given the money that flows through the sector.
Although to date there have been no technical details released, the loss of the firm’s access to key business systems seems to align with the damage a ransomware attack can cause. Ransomware is designed to cause immediate outages to critical business systems to encourage the victims to pay ransoms to criminals.
They are typically caused by unprotected company devices being compromised, employees visiting malicious websites or through opening infected email attachments. Ransomware attacks causing a domino effect against a company’s other group firms increases the pressure for a ransom to be paid.
Keeping company devices up to date and training staff on cyber security awareness are good starting points for all businesses as they build natural cyber resilience to different kinds of cyber risk. Having secure builds for new systems (devices, cloud platforms, websites etc.) and strong identity controls (e.g., strong unique passwords, multi-factor authentication) will also help achieve strong cyber resilience.
Aside from those processes which are relevant for almost all businesses, firms can carry out a cyber risk assessment to identity which specific risks apply to their company. Any effort or budget spent on security should address the key risks.
As not all breaches can be prevented, it’s important firms also have monitoring in place so they can detect and respond to incidents. One easy and free way to detect when your personal or company data may have been compromised is HaveIBeenPwned.com
You can check if your email or phone number has been reported in a public data breach and sign up for alerts if your data is included in a future public breach. Should you find your details are involved in a breach, we highly recommend you change your passwords immediately and activate multi factor authentication on all applications which cater for this.
Kloudwerk works with you to help you keep cyber criminals out. We offer affordable cyber security consultancy packages for business customers. Please
consult our Cyber Consultancy page for more information.
