High street stationery and book retailer WH Smith disclosed it has been the target of a cyberattack affecting employee and personnel data. It stresses that customer accounts and databases were not affected by the attack as they are stored on separate systems.
On Thursday, the company said it “immediately launched an investigation, engaged specialist support services and implemented our incident response plans, which included notifying the relevant authorities” in a public statement after this incident.
Just last year, Funky Pigeon, one of WH Smith’s brands was also affected by a cyberattack, which halted online sales for a week.
Andy Norton, European cyber risk officer at Armis noted that “”Hackers thrive on being able to move laterally across systems and assets in organisations. This makes having total visibility over all managed or unmanaged assets on a network, along with oversight of every connection they’re making and recognition of any anomalous behaviours an imperative to maintaining cyber resilience. Organisations that have these abilities will be able to readily remediate issues, respond quicker and ultimately better protect themselves in the long run.”
He also cautioned: “Any organisation that connects with WH Smith should now be on high alert and ready to assess the risk to their organisation as a result of this attack.”
Darren James, Senior Product Manager at Specops Software, an Outpost24 company, also noted that “Although this latest breach didn’t effect customer data it still follows concerning trend that well established brands are still vulnerable to attack. We don’t have the details of how the breach occurred, but as it is reported that it is current and former staff personal details that were accessed, this appears to have been a breach of HR system of some kind. It doesn’t matter whether it was an internal system or an external SaaS solution that was breached the importance of access controls, vulnerability management and threat intelligence has never been more important.”
In a statement WH Smith said it “takes the issue of cybersecurity extremely seriously and investigations into the incident are ongoing. We are notifying all affected colleagues and have put measures in place to support them.”
Darren Guccione, CEO and co-founder at Keeper Security said of the attack: “In cases where personal information is stolen, threats from the data breach persist even after it’s been discovered and contained. Current and former employees of WH Smith should take proactive steps to protect themselves from cybercriminals who may aim to use their personal information for identity theft and targeted attacks.”
He also noted that “The first step should be signing up for identity theft protection services. This is also a good time for those affected to change any work-related passwords along with updating other accounts that reuse those passwords. We recommend strong, unique passwords for each account that are at least 12 characters with upper and lowercase letters, numbers and special characters. Secure password management software can help create and store passwords for you. A dark web monitoring service can also alert you if your information shows up on the dark web so that you can take immediate action.”
From a retailer perspective Erfan Shadabi, cybersecurity expert at comforte AG stressed that “retailers are a prime target for cybercriminals due to the volume of sensitive information that they store and handle, making them vulnerable to various types of cyberattacks, including phishing, malware, and ransomware.
“Businesses in these sectors need to apply data-centric protection to any sensitive data within their ecosystem (PII, financial, and transactional) as soon as it enters the environment and keep it protected even as employees work with that data. By tokenising any PII or transactional data, they can strongly protect that information while preserving original data format, making it easier for business applications to support tokenized data within their workflows. They also need to revisit their enterprise backup and recovery tactics to ensure that they can quickly recover if hackers are able to get into their environment and encrypt their enterprise data. Also retailers should have a response plan in place in case of a cyberattack. The plan should include steps for containing the attack, notifying affected parties, and communicating with stakeholders,” Shadabi advised.