Month: August 2025

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware

Frequency of Cyber-Attacks and their Effects

There is a lot of discussion around the number and effects of cyber-attacks in the UK and beyond.  There are those who believe that the instance is under reported, often because the organisation under attack is concerned about reputational damage and this can be a contributing factor to many paying up when subject to a ransomware attack.  And there are those who think the number of attacks is over estimated, especially in reports commissioned by vendors of cyber-security products, to scare up business.  Personally, I can see both arguments, but I tend to come down on the side of under reported.

The exact number of UK businesses failing solely due to cyber incidents is difficult to pinpoint, research indicates that a significant percentage of businesses have been impacted by cyber-attacks, and a substantial portion of those that are targeted end up closing down. Specifically, one study showed that 60% of small businesses close within six months of a cyber-attack. Furthermore, a recent report states that more than one in four UK businesses have experienced a cyber-attack in the past year.  The sources I used to put this together include:

  • Cyber security breaches survey 2024 – GOV.UK9 Apr 2024
  • Which UK
  • Raconteur







  • Simpson Wreford LLP








Note:  I did not use data from reports commissioned from Vendors.

Let’s take a closer look:

  • Prevalence of cyber-attacks:
  More than 25% of UK businesses have reported being hit by a cyber-attack in the past year.



  • Impact on small businesses:
  A concerning 60% of small businesses fail within six months of experiencing a cyber-attack. 





  • Factors contributing to business failure:
  Cyber-attacks can lead to financial losses, reputational damage, data breaches, and operational disruptions, all of which can severely impact a business’s ability to survive, especially small businesses. 





  • Business impact:
  The survey we mentioned highlighted that nearly three-quarters of business leaders believe a cybersecurity incident will disrupt their business in the next 12 to 24 months. 
  • Specific examples:  
In the past few months, major UK retailers like Marks and Spencer, the Co-operative Group, and Harrods have been targeted by cyberattacks as well as businesses that have now ceased trading, such as Knights of Old.

While these statistics highlight the severity of the issue, it’s important to note that cyber-attacks can be a contributing factor to business failure, rather than the sole cause. Other factors like poor management, economic downturns, or market competition can also play a role. However, the increasing sophistication and frequency of cyber threats make it crucial for businesses of all sizes to prioritise cybersecurity measures to mitigate risks and protect their operations. 

With my focus remaining with SMEs, it concerns me that SMEs of all sizes still do not prioritise cyber security other than putting a tick in the box, by, for example, obtaining certifications like cyber essentials.  Whilst this is a good thing and not to be dismissed, they are often doing this for marketing purposes rather than any commitment to cyber security which can mean that once the certification is obtained for a 12 month period, standards can then be let slip and I base this on obtaining the certification for a client, returning 12 months later, and finding many of the same issues recurring that we dealt with the year previous.

Cyber criminals target SMEs, don’t think that because an SME has smaller revenue and therefore smaller reward for the criminal, that they are immune.  SMEs are often targeted because they will have spent much less in terms of money and effort in protecting themselves against attacks.  They lack good advice and guidance, they can’t afford a full-time cyber security professionals and in fact, probably don’t need one full time, but they do not seek that vital guidance.  SMEs must understand that they are seen a low hanging fruit.

I’ve made this final point many times, and that is cyber awareness training.  Most cyber-attacks begin with some form of social engineering.  Your company will be profiled, and the attacker will obtain information from open sources such as companies house, your website and marketing, simple phone calls to obtain names and phone numbers etc.  Then comes the emails phishing for information or to plant malware on your systems.  The first line of defence here is always your employees, the more they know, the more they can protect your business.  Cyber Awareness training is not a nice to have, it’s essential and is the cheapest and quickest win you can make in your cyber defences.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Supply Chain Security

The Effects of Downtime on Your Business Can Be Devastating

I’ve talked in the past about what SMEs really care about when it comes to cyber security.  Do they really care about the technicalities of an attack or scam?  Do they really care about the technical aspects of a piece of protective software or hardware?  My argument is that they neither need nor want to know how this stuff works.  What they do want to know can be summed up pretty easily.

  1. How vulnerable are they to an attack and/or scam?
  2. What would be the effects if that attack or scam succeeded?
  3. What can they do about it, and how much will it cost them?

I wrote mostly about points a and c in a blog earlier in the year, https://hah2.co.uk/what-do-sme-owners-and-directors-want-from-cyber-security/, and I’ve included the link if you want to read it.  This time I’m concentrating on point b and the effects of the downtime that it creates.

Downtime following a cyberattack can have serious consequences for businesses, and individuals. We can categorise these into several key areas:

  1. Financial Costs
  • Lost Revenue: For e-commerce platforms, financial institutions, or other time-sensitive industries, downtime directly results in revenue losses.  All businesses will suffer some degree of revenue loss if they can’t carry out their business because their access to suppliers, customers and operations are seriously curtailed.
  • Operational Costs: Companies may need to pay overtime to staff to keep the business going manually without access to IT, hire external cybersecurity experts, or invest in replacement hardware or software.
  • Regulatory Fines: Non-compliance with regulations like GDPR or industry focused standards, due to downtime or data breaches can lead to significant fines.
  • Damage to Reputation
  • Loss of Customer Trust: Downtime can erode confidence, especially if sensitive customer data is exposed or if services are unavailable for extended periods.
  • Brand Damage: Affected organisations may face negative publicity, making it harder to attract and retain customers or partners.
  •  Operational Disruption
  • Service Outages: Critical systems might be offline, affecting production lines, supply chains, or essential services.
    • Loss of Productivity: Employees unable to access IT systems are effectively idle, causing delays in work and project completion.

Note:  Points d and c were what essentially led to the collapse of Knights of Old.  When they were hit with a ransomware attack which took out their IT systems, they were unable to fulfil time sensitive orders which led to the cancellation of those orders, damaging their brand and seriously impacting customer trust.  They never recovered and are now out of business.

  • Data Loss
  • Corruption or Deletion: Cyberattacks like ransomware can encrypt, leak or destroy critical data, which may take days or weeks to recover, even with backups.
  • Intellectual Property Theft: If attackers steal proprietary information, it can be sold to competitors or leaked online.
  • Security Gap
  • Exploitation of Vulnerabilities: Downtime often exposes weak points in an organisation’s infrastructure, which may need to be patched or rebuilt.
  • Increased Risk of Future Attacks: Downtime may signal to attackers that the organisation is a viable target.
  •  Legal and Regulatory Implications
  • Breach of Contract: Failure to meet service-level agreements (SLAs) due to downtime can result in legal action from customers or partners.
  • Insurance Implications: Cyber insurance claims may be denied if the company failed to follow adequate preventative measures.
  •  Psychological and Social Impact
  • Employee Stress: Staff may feel pressured to resolve issues quickly, leading to burnout.
  • Customer Frustration: Extended downtime can alienate loyal customers, particularly in industries where continuity is critical, such as healthcare or finance.
  •  Broader Economic and Societal Impacts
  • Supply Chain Disruption: Downtime in one organisation can ripple through its partners, affecting entire supply chains.
    • Critical Infrastructure Risks: Attacks on essential services like utilities or healthcare systems can have life-threatening consequences.

I have blogged many times about the mitigation strategies you can take, that don’t need to break the bank, but the bottom line, proactive measures can significantly reduce the impact of cyberattacks and the associated downtime.  Understand your vulnerabilities and threats, base your spend on protecting against those threats, starting with the most serious, and then working down.  Don’t try and get to 100% security, it doesn’t exist, so understand what risks you find acceptable and what risks you don’t.

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Security Security Tools

PROACTIVE CYBER SECURITY

Proactive security, protective monitoring, security operations – all pretty much means the same thing in terms of cyber, at least in the corporate world and the larger, more sensitive Government organisations.  I’ve been involved with the design and commissioning of security operations centres for a long time.  I designed the first for the FCO, under contract to HP, ran the security team for the Identity and Passport Service which included a security operations centre, amongst others.  But the one thing I knew, was that it was too complex and expensive for an SME, even though it would bring them great benefits.

I’ve been talking and posting a lot recently about this subject because I think it’s extremely important and hasn’t, in the past, resonated with SME owners and management simply because it was considered by many to be purely in the province of the corporate world and was way too expensive for an SME to even consider.  Well, that cost issue is no longer the case and there is a system, which we use to provide a managed service for SMEs, that is very affordable.  So that leaves us to consider whether it is something that an SME would consider as an essential element of their cyber defences, now that it is affordable.

Typically, an SME would generally want such a solution that balances strong security coverage with affordability, simplicity, and minimal disruption to daily operations.  Here’s what I think they would like to include if they could afford it.

  1. Comprehensive Threat Visibility
  • Log collection from key systems (servers, endpoints, cloud services, firewalls, applications).
  • Real-time monitoring for suspicious activities (e.g., failed logins, privilege escalation, data exfiltration).
  • Ability to spot both external attacks (phishing, malware) and insider threats.
  • Actionable Alerts, Not Noise
  • Intelligent alert prioritisation to avoid alert fatigue.
    • Context-rich notifications so the SME knows what happened, why it matters, and what to do next.
    • Possibly AI-driven correlation of events to detect patterns.
  •  Ease of Use & Low Overhead
  • Simple dashboards that non-experts can navigate, or more likely, a managed service as an SME will have little or no resource to give to this.
  • Minimal in-house expertise required to operate.
  • Fast onboarding and configuration.
  •  Reporting
  • Reports that are east to read, management focused and not full of jargon.
  • Audit trails for investigations.
  • Incident Response Integration
  • Clear escalation paths (automated and manual).
  • Integration with existing tools (ticketing systems, email, Slack/Teams).
  • Ability to block malicious IPs or disable compromised accounts quickly.
  • Affordability & Scalability
  • Pricing that fits SME budgets (no enterprise-only costs).
  • Scales up with business growth without a full rip-and-replace.
  • Easy and flexible deployment.
  • Coverage regardless of where your staff work, in the office, remote or on the move.
  • Resilience & Reliability
  • Works even if parts of the infrastructure are down.
  • Secure storage and backup of monitoring data.
  • Regular updates to threat detection rules.

In short: An SME doesn’t just want raw data — they want reassurance, clarity, and quick guidance so they can protect their systems without hiring a large security team.  And that’s what we are offering, assurance.  There’s no such thing as 100% security, so if you’re looking for that, then we can’t help you.  Using this system our managed service plays the percentages by monitoring your defences, telling you in no uncertain terms where your defences aren’t up to the job, alerting you to problems and providing advice and guidance on how to fix stuff.

So, what exactly are we offering.  Well, it’s a 24/7 service which provides a manned interface between you and us, on the end of the phone or by email in working hours, and an automated response service in silent hours.  Doing it that way you don’t have to pay for expensive night shifts.  The staff on duty don’t just monitor your systems but provide advice and guidance as well, giving you a cyber security resource on tap.

Specifically, we are covering off:

Email Security – Stay ahead of potential email threats with our user-friendly, API-based active protection.

Endpoint Security – Safeguard laptops and desktops against cyber threats like malware and ransomware.

Cloud Data – Enable cloud data protection for secure collaboration with external users.

Secure Browsing – Keep your browser secure with a provided extension, protecting you from viruses and malicious sites.

Awareness Training – Empower employees to be the first line of defence against the ever-evolving landscape of cyber threats.

Phishing Simulation – Regularly simulate cyber-attacks, including phishing emails, to identify vulnerabilities and educate staff to the dangers of Phishing.

External Risk – Obtain actionable insights on external threats by scanning your digital footprint and exposed vulnerabilities. This includes regular scanning of the dark web looking for compromised email addresses and credentials.

Insurance – Mitigate the cyber risk associated with evolving threats through tailored coverage at the right price (optional; aligning your premiums with your security posture can lower those costs).

Here are some questions to ask yourself and if you answer yes to most of them, then you might be a fit for this service:

  • Do you employ around 1-250 staff members?
  • Does falling victim to cybercrime worry you?
  • Could you continue to operate your business without your IT systems?
  • Is a recent cyber scan of your public domain on your radar?
  • Are you aware of the constantly evolving cyber threats and tactics?
  • Does your business need protection against these advancing cyber threats?
  • Are you looking for coverage under a cyber insurance policy?

Keep your eye out for a webinar that we will shortly be doing which will provide a full demo of the system, or if you prefer, contact us and we will give you a one-to-one demo, with no obligation.  You can follow this with a totally free 14-day trial covering your whole estate, again with no obligation.

If you wanted this system, you might still think it’s too expensive for you, well, it’s only £14 per user per month, so if you only have 10 IT users amongst your staff, that would be £140 per month on a rolling 30-day contract i.e. you can quit with just 30 days’ notice.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Working Practices

Scams v Hacks

We hear a lot about the consequences of cyber-attacks and data breaches but not a lot about the specific threats against SMEs, rather than the generic threats against all businesses.  In general businesses are more likely to be targeted by scammers (social engineering attacks) than by purely technical attacks.  But why?  Attacks against individual SMEs are not going to bring in a lot of profit for the criminal, so they often go after multiple targets all at once.  How they do that is to craft an attack which can be automated and directed at many SMEs all at once.  The easiest way to do that is via a social engineering attack.  Let’s take a look at what we mean by that.

Scams and social engineering attacks rely heavily on human error.  Not only do SMEs have weaker defences than their corporate cousins, but they spend little, if anything, on cyber awareness training.  The attack that brought down Knights of Old, reducing a once thriving business to bankruptcy in a frighteningly short time, was the result of a weak password being cracked.  That suggests that OK, a stronger password protocol and the use of MFA would have been of great benefit but so would educating the users about social engineering and how they can protect the company and their jobs.

Typically, we see:

  • Phishing emails that trick employees into giving credentials or downloading malware.
  • Business email compromise (BEC) — attackers impersonate executives to request bank transfers or the immediate payment of an invoice.
  • Fake invoices or supplier fraud.

It’s done this way simply because it’s easier and cheaper to execute than a technical attack.  It’s scalable with scammers sending thousands of phishing emails, and it often bypasses technical defences by exploiting people directly.

In addition to the traditional attacks, we are now facing AI generated attacks, enabling criminals to design scams that are even more scalable and to be produced more quickly.  Some examples include:

Deepfake CEO Fraud (AI-Generated Voice or Video)

A finance employee receives a video call from someone who appears to be the CEO instructing them to urgently transfer funds to a supplier. The video and voice are AI-generated deepfakes using real footage and voice samples taken from public online sources.  This has happened in the UK causing a UK based firm to lose over £20m in early 2025.  Obviously not an SME but the attack was not difficult to generate.

Another AI attack was an upscale of the Business Email Compromise:

Criminals use AI to monitor and mimic email communication styles. They craft perfectly worded emails from a company executive asking the accounting team to update supplier bank details or pay fake invoices.  What is new in 2025 is that AI now personalises these scams based on internal speech patterns and tone scraped from Slack or Teams (when credentials are compromised and that list is not exhaustive – other online messaging systems are available).

One scam that we are now seeing more of is the fake job applicant scam targeting HR departments and IT onboarding teams.  Scammers apply for remote jobs using fake CVs and AI-generated video interviews. Once hired, they gain access to internal systems and exfiltrate data or install malware.  They’re playing the long game here, but it can really pay off.

There are lots of examples and I’ll just put in a couple more:

How many of you use Software as a Service (SaaS) and pay a subscription? In this case a fake renewal notice is sent for services like Microsoft 365, Zoom, or Slack. The email contains a link to a spoofed portal, which steals company admin credentials when they try to “log in.”   A new twist in 2025 is that the phishing emails are personalised with real invoice numbers and recent usage data scraped from prior breaches.

Most of you are probably on LinkedIn, even if you are not particularly active on there.  We are now seeing more of the LinkedIn Clone Attack.  What happens here is that the scammers clone the LinkedIn profile of a known business leader and use it to reach out to employees or partners, proposing urgent collaborations or investment opportunities that include malicious links.  In a more advanced tactic, they use AI-generated responses in real-time chats that make these accounts seem very real.

So, in conclusion, whilst we cannot rule out the more technical attack on an SME, we can say that the most likely attack will come via some sort of scam, often nowadays using AI.  The defences need to be in depth and will include some technical defences but often the best defence against social engineering is cyber awareness training and this is generally ignored by SMEs.

Scroll to top