Cyber experts have spoken out in the wake of the arrest of a man in his 40s, by the National Crime Agency (NCA) in connection with a recent cyberattack that caused significant travel disruption at several major airports, including London Heathrow.
The suspect was detained on suspicion of offences under the Computer Misuse Act and has since been released on conditional bail.
The NCA confirmed the arrest is a crucial step in the early stages of a continuing investigation. Paul Foster, the head of the NCA’s National Cyber Crime Unit, stated that cybercrime is a persistent global threat causing substantial disruption to the UK. He also reiterated the agency’s commitment, along with its international partners, to reducing that threat to protect the public.
In response to the news, Ryan McConechy, CTO at Barrier Networks said: “It is a positive update that a suspect has already been arrested in connection with this attack. It also highlights the priority law enforcement is placing on catching the perpetrators of cyber crime today. While details are still emerging, the NCA has confirmed that the suspect was arrested in the UK, which will likely come as a surprise to many.”
McConechy went on to say that speculation suggesting the attack was carried out by a state-sponsored actor, potentially linked to Russia, and now debunked, raises the question about whether the breach was executed by Scattered Spider, a known Western threat actor, which recently announced its retirement.
He said: “While more information is likely to surface soon, the incident once again highlights that no organisation is immune to cyber crime today. Whether attackers hit an organisation directly, or impact a large pool of organisations through a supply chain, cyber crime affects all businesses.”
Widespread disruption
The alleged attack targeted Collins Aerospace, a software provider whose systems are used for check-in and boarding at airports across the globe. The disruption led to flight delays at major hubs in London, Brussels, and Berlin. Passengers faced further delays throughout the week as airports worked to restore normal operations.
Justin Kuruvilla, Chief Cyber Security Strategist at Risk Ledger, former UK National Cyber Security Centre (NCSC) advisor and ex-US Department of Defence technical director has shared his thoughts, saying: “This incident is a stark reminder that cyber threats pose significant risks to all organisations, small and large. Even the most mature organisations with robust controls and processes understand that it’s a matter of “when, not whether” they will experience a breach.
It sounds like the airports were quickly able to implement their incident response procedures, and thus managed to keep many flights in the air, rather than having to shut down operations completely.
While many actors continue to target the aviation industry, we recognise the industry’s efforts to enhance collaboration (between airlines, airports, suppliers, etc.) to share supply chain intel and understand the critical dependencies and risks facing the entire sector. This is the right way forward to further boost operational resilience across the sector.”
Adam Blake, CEO and Founder of ThreatSpike, said he was “deeply concerned” but also, “not surprised” by the scale of the cyberattack on European airports. “The cybersecurity industry has shown a colossal failure in protecting businesses where it matters. Businesses are pouring vast sums of money into advanced security tools and bolt-on solutions, but it’s just fragmenting security posture, creating overlapping controls and gaps for adversaries to exploit.”
Ransomware and anti-terror regulations
In the wake of the incident, an independent reviewer of terrorism legislation, Jonathan Hall KC, suggested that a state-sponsored hacking group could be behind the attack, noting that while states are a possibility, very powerful and sophisticated private entities could also be responsible.
A Heathrow spokesperson also said that while the “vast majority of flights” were operating normally, check-in and boarding times for some flights were longer than usual. The spokesperson added that the affected system was not owned or operated by the airport, but that it was providing support to airlines and assisting passengers.
Blake said a wider strategy that takes many more variables into play, must be adopted to help prevent such attacks in future: “The cybersecurity model is clearly broken. Cybersecurity vendors have a responsibility to try a lot harder in educating businesses on where their gaps are, because it’s clear that they don’t know. There’s a global obsession with adopting a checklist of tool and that’s just not a viable solution. Cybersecurity needs to be treated a lot more holistically, as a strategic priority built on end-to-end visibility, consistent monitoring and response, and proactive threat detection. Where organisations stitch together a patchwork of vendors, vulnerabilities will inevitably emerge.”
The incident also highlights the risks associated with airports’ reliance on external suppliers for critical technology. Shares in several major airlines, including British Airways owner IAG and easyJet, saw a drop in early trading on Monday following the attack. The cyber-attack is the latest in a series of similar incidents affecting British companies this year, including carmaker Jaguar Land Rover and retailer Marks & Spencer.
McConechy added: “We don’t know how the attack was executed, but we do know ransomware was involved. Organisations must learn from this and prioritise their defences against the vector.
This means training staff regularly, patching vulnerabilities, deploying phishing-resistant MFA capabilities, inventorying assets, monitoring the security of suppliers and applying network segmentation to protect an organisation’s most important assets.
In addition to this, it is also vital that organisations run regular incident response planning to ensure they can remain operational, even when disaster strikes.”
