Sectors

Retained to evaluate the effectiveness of the existing cybersecurity strategy by defining a set of critical loss exposure scenarios and testing control effectiveness in mitigating a few, high impacting scenarios.

Based on the simplicity of the approach the client allowed us to develop and implement the business resilience programme as a fully outsourced service, the Information Security Management System (ISMS).

This included developing top level policy statements and a full set of information security procedures and the crises management system, including an overarching incident response process and procedure, a cyber incident playbook and a disaster recovery procedure for several of the firm's critical applications.

For a national gas transmission organisation that included elements of critical national Infrastructure, we led a risk-based, business and regulatory focused Industrial Control systems (ICS) security review on several critical assets across multiple countries.

We then performed an actuarial-led cyber risk quantification exercise to determine the full quantum cyber exposure. Lastly, we developed a blueprint of a secure and resilient architecture against industry good practice, such as NIST 800-82 and ISA/IEC 62443 and designed a multi-year investment plan to deliver the secure architecture across dozens of sites.

The plan was presented to the UK regulator and accepted as the basis for a 5-year transformation.

Successfully obtained injunctive remedies against former employees of a Plc energy broker client who used sophisticated data extraction software to obtain highly confidential information.

The speed and effectiveness of our actions were instrumental in protecting the misappropriated data and limiting the damage sustained by our client. The case proceeded thereafter and was successfully resolved at mediation, with a negotiated resolution.

The sole director of a claims handling business faced prosecution by the ICO for criminal breaches of the Data Protection Act 2018 and money laundering offences at the Crown Court.

The case involved an agreement to purchase data illegally obtained by the employee of a nationally recognised insurance company, relating to the details of motor insurance claims arising out of road traffic collisions. The parties involved were then the subject of “cold-calling” sales calls to engage the client’s company to bring motor and personal injury claims on their behalf.

We represented the client in the court proceedings, highlighting relevant mitigation and liaising with the prosecution to ensure the client received a favourable non-custodial sentence and avoided the need for lengthy contested proceedings. We also negotiated a favourable confiscation order, which the client was able to discharge without the forced sale of his home and other personal assets.

The case is one of only a handful of criminal prosecutions brought by the ICO.

Our client’s CEO was spear-phished, leading to a doxing attack on its case management system. Hackers stole a staggering 6TB of data and then presented ransom demands to avoid its publication and distribution on the dark web. The stolen data was thought likely to include personal and special category information belonging to tens of thousands of individuals.

The client’s case management system was a legacy system, which meant datasets stolen by the hackers were unstructured, posing a challenge to assess the severity of the breach.

We repurposed scripts from proprietary software to scan the data sets and draw out personal information based on predetermined parameters. This allowed assumptions to be made about the content of the data, which were then cross-checked by manual review of random samples. This regime drove a highly reliable 98% rate of accuracy and a sound basis for justification of the approach to the regulator.

Meanwhile, we collaborated in sharing evidence with the NCA in the UK and other international law enforcement agencies, which led to the identification of several other victims and ultimately the successful take down of servers being used by the hackers to host the stolen data across the EU and US.

Hackers stole a staggering 3TB of data and then presented ransom demands to avoid its publication and distribution on the dark web. The stolen data included personal and sensitive personal information belonging to tens of thousands of individuals.

We devised the response strategy and then brought together a specialist team to seamlessly deliver the remedial action required. This included negotiations with the threat actor, the restoration of data from back-up and remediation of the client’s environment, an ICO investigation, and notifications to the client’s key customers and stakeholders. 

Our efforts resulted in nil claims and no enforcement action for our client.

We designed the legal architecture and advised on the complex data and IT elements of MyLicence – one of the UK’s largest ever data projects - a successful collaboration between our client, the MIB, and the DVLA. My Licence is a revolutionary data sharing scheme, endorsed by HM Government, the DfT, the ABI, and wider insurance industry to combat insurance fraud. At its core is a comprehensive UK database of all licensed drivers and motor insurance policies.

We also provided advice on interoperability, facilitating the legal transfer of millions of data points through to preparing and negotiating the entire supporting contractual framework. The project’s political and strategic importance, not to mention its numerous stakeholders, demanded high attention to potential sensitivities and conflicts.

Advising a leading MGA on the transfer of personal data from the UK to the USA and China, including drafting associated data processing and distribution agreements in compliance with UK, EU, US, and Chinese data privacy laws.

We are also advising on interactive platform data processing terms and negotiating publicity agreements with celebrities and medical professionals.

We worked with a leader in benefits provision and pensions administration to support their client base by developing and embedding a cyber training programme and audit benchmark into the onboarding of every new pension scheme.  This programme was based on the pensions regulator (TPR) requirements relating to cybersecurity.

The training focused on raising awareness of the cybersecurity responsibility of trustees in managing the sensitive data and finances entrusted to them.  It then focused on reducing overall risk at the scheme by carrying out an expert-led audit of their technology and cybersecurity arrangements.

We developed a tailored menu of critical risk reduction services including cyber tabletop exercises, third-party risk assessments, a suite of data protection & handling policies, and a bespoke incident response service for schemes.

After carrying out numerous scheme audits, we developed a cybersecurity benchmark that now provides instant insight to pensions providers on the maturity of their cybersecurity arrangements depending on the size, complexity and amount of funds under management.

A university whose Office365 environment was breached fell victim to a Business Email Compromise, affecting both staff and students. Incident protocols were inadequate, so they reached out to us for help.

Using proprietary technology, we were able to accelerate our analysis of the attack’s scope and risk assess all affected accounts, before reporting to the client with our findings within just four days, also limiting the need for further manual analysis of those accounts deemed to be at ‘high risk’ by the client’s HR team.

Gun to tape, we resolved the incident in less than four weeks.

We managed the response to a data breach arising from a configuration error on software used to produce statistical analyses from crime occurrence logs. The breach involved the inadvertent disclosure on-line of highly sensitive and detailed data on sexual offences, including victims and perpetrators.

Key activities included risk assessing, notifying and counselling the affected individuals, media engagement, representing our client in the regulatory investigation, identification and remediation of the relevant configurations, and advice on improvements in detection and governance.

We were retained to help assess the cyber maturity and privacy vulnerability of an organisation involved in the processing of personal data on millions of individuals for the UK government.

The analysis was split into key workstreams focused on the security of the existing IT estate, the organisation’s principal processing activities, the categories of data concerned, the people involved, and the enabling systems and software. Exposures were then evaluated on a range of scenarios, modelling a variety of financial and reputational consequences.

Based on the findings, the organisation’s executives and responsible officers were able to assess their appetite for risk retention to an acceptable level against a measurable scale, simultaneously identifying the areas of exposure and indicators of tolerance at which transfer out would be deemed preferable or even essential.

These findings were then used to perform further assessment upon the adequacy of the organisational and technical measures employed (per GDPR), as well as the adequacy of existing insurance and other third-party contractual arrangements underpinning the incumbent risk transfer regime.

We carried out an insurability assessment for the client by quantifying their cyber exposure based on the number and sensitivity of the records being hosted and processed to determine the insurance limits required. We then measured the client’s insurability through the maturity evaluation of key technical controls required by insurers when providing cyber insurance quotes to give our client an indication of the transferability of the risk through cyber insurance.

Our client was a government agency who fell victim to a ransomware attack following lateral movement into its environment from a connected environment under the control of a managed service provider. We advised on incident management, crisis communications, regulatory obligations, injunctive relief, and a financial recovery from the MSP.

The situation was challenging because our strategy had to balance a zero-tolerance approach towards any engagement with the threat actor with our client’s obligations under privacy law in circumstances where none of its affected data was recoverable from backup.

A careful plan was devised in collaboration with the NCSC to secure any data leaked on the dark-web while ensuring the matter was delay with discreetly. Meanwhile, we coordinated containment, threat hunting and forensics to eradicate the threat actor’s persistence and to gather evidence necessary to prove a failure of technical measures, gross negligence, and a breach of contract by the MSP.

Following a series of intimated claims for alleged cookie violations, our client became suspicious not only about the claimant’s motive and identity, but also the claims’ presentation generally, owing to the inclusion of video files and other executables purporting to demonstrate, on a step-by-step walkthrough of a user’s typical journey through the client’s website, how the alleged violations had occurred.

We suspected that the claims were a stalking horse or ‘staging’ for the deployment of malware on our client’s IT network, to facilitate wider disruption or possibly a ransomware attack at an undefined future date. We segmented the suspicious files and moved them to a secure ‘sandbox’ environment for further analysis, before sharing our findings with the police’s fraud investigation unit.

This allowed similar victims to be identified and, in combination with the evidence of those other victims, created the basis for a case against those responsible for various offences under the Computer Misuse Act.

Appointed to assist with the response to an ICO investigation following alleged breaches of the DPA 2018 arising out of a request for personal data from a dismissed senior employee.

The employee had made a Subject Access Request for their personnel file and disciplinary records which had been prepared following an internal investigation which had led to the employee’s dismissal. Our client had initially responded to the employee, refusing to provide the information requested. The employee had complained to the ICO who had written to our client requiring them to review their response and remedy any breaches.

We were able to remediate the breaches. We reviewed the request and our client’s response and assisted with an internal review. Furthermore, we supported with the preparation and redaction of material and engaged with the employee and the ICO on our client’s behalf.

The ICO were satisfied with our client’s actions and took no further action. The employee was provided with the information and decided not to bring a claim for unfair/wrongful dismissal.

We successfully obtained an ex parte injunction and search order following a senior employee’s misappropriation of electronic data worth £5 million+ on a ‘BYOD’ mobile phone. 

This allowed for forensic imaging to preserve evidence of misuse, leading also to admissions of wrongdoing from the Defendant and a settlement on terms that included deletion of the misappropriated data and undertakings to the Court to restrain the Defendant’s future activities.

A key member of our client’s supply chain was targeted by hackers who encrypted its systems and launched a DDoS attack on its website when it refused to pay a ransom. The impact on our client was significant across its global customer base.

We engaged with the incident response vendors acting for the supply chain partner to understand the security risk to our client through connected systems and then created a red network to contain any propagation, while hardening controls and stepping up threat hunting on the rest of the environment.

We also checked the extent of third-party processing and data deletion to create a profile of the data subjects likely affected for whom our client had responsibility as controller, and thereafter notifying and liaising with the relevant supervisory authorities, while risk assessing and making notifications to individuals as required by law.

Our mitigation steps were highly effective, resulting in just a fortnight’s disruption and no loss of revenue for our client.

Retained by the head of operational technology in a global industrial manufacturing and process automation giant, to carry out a cybersecurity best practice review. This covered 16 business units - covering power generation, transmission, industrial manufacturing, robotics and consumer goods - in 5 countries to better understand where operational and project pressures led to cybersecurity risk.

After presenting the findings internally to all business units, we also presented the findings and recommendations in conjunction with the client at the SANS European ICS Security summit as a sample of a business-focused approach to cybersecurity strategy.

Disciplinary proceedings were brought against a junior member of staff for persistent absence that led to the discovery of a series of serious sexual assaults against the employee by their supervisor. A criminal investigation was duly launched by the police, simultaneous with the client’s own process.

A member of HR subsequently shared confidential documents by mistake with the alleged offender which included exchanges with the police, as well as details on the victim’s whereabouts, a safehouse address and new mobile contact telephone number. So serious was the risk of harm to the victim that the alleged offender’s own solicitor raised the alarm upon learning from their client that this information had come into his possession.

We acted for the client, advising on a DPIA for the original disciplinary action before notifying, and then liaising closely with the ICO to explain the circumstances of the breach and make representations on the client’s behalf to avoid sanction. We advised the client in parallel on urgent mitigation, which included moving the victim to a new address.

The ICO issued recommendations for improved procedures and training for the client’s HR staff on data protection, but otherwise imposed no further sanctions. In reaching its decision the ICO commented on and commended the client’s swift response and transparency, as well as the original DPIA, which had identified the disclosure risk, demonstrating the client had been aware of and recognised the importance of protective measures, whilst noting in contrast that human error by a lone employee not following the prescribed procedure was ultimately to blame.

We defended a software developer against claims of patent infringement in multiple jurisdictions. At issue was specialist software designed to overcome latency and facilitate uninterrupted website access at times of peak demand.

Evidence was deployed demonstrating the contested patent was invalid. Moreover, after disclosing a highly technical Product and Process Description early in the litigation, we also helped to establish that the client’s software did not infringe in any event.

Our client disputed a local authority’s unilateral amendment to a Service Delivery Agreement (SDA). The SDA was a major contract with a 20-year term for the delivery of key IT services, awarded following a procurement competition.

The local authority attributed the change to an unforeseeable reduction in demand for the services originally envisaged. The potential financial impact of the change to our client would have been close to an eight-figure sum annually.

We advised on the law and the contractual position, resulting in a constructive dialogue between the parties and an early resolution without the need for High Court intervention.

Review and negotiation of app development contracts for a leading app development company. One contract example includes Sail GP which produced a next generation app with a world first fan experience for a new global sports league.

The agreement between our client and Sail GP has a global reach and high intellectual property value, and accordingly required extensive and specialist consideration with strong intellectual property protection. The SailGP agreement and work was shortlisted for “Best Innovative Campaign” for world first sport fan experience.

Emails were intercepted and invoice details manipulated, allowing fraudsters to divert funds during a container leasing transaction between our client, a marine cargo company in the UK, and the counterparty in Latvia.

We secured and removed the threat actor’s presence from the client’s IT environment, while simultaneously tracing and successfully recovering 80% of the diverted funds from a network of banks across the UK, Spain, and France.

Advice on processing personal information collated from over 5 million annual customer interactions in 20+ countries across five continents. We devised the optimum contracting structure, factoring requirements for international data transfers to ensure global compliance.

Further work included updating privacy notices and cookie policies through to preparing international data transfer arrangements, third-party processing contracts and intra-group data sharing agreements.

Disciplinary proceedings were brought against a junior member of staff for persistent absence that led to the discovery of a series of serious sexual assaults against the employee by their supervisor. A criminal investigation was duly launched by the police, simultaneous with the client’s own process.

A member of HR subsequently shared confidential documents by mistake with the alleged offender which included exchanges with the police, as well as details on the victim’s whereabouts, a safehouse address and new mobile contact telephone number. So serious was the risk of harm to the victim that the alleged offender’s own solicitor raised the alarm upon learning from their client that this information had come into his possession.

We acted for the client, advising on a DPIA for the original disciplinary action before notifying, and then liaising closely with the ICO to explain the circumstances of the breach and make representations on the client’s behalf to avoid sanction. We advised the client in parallel on urgent mitigation, which included moving the victim to a new address.

The ICO issued recommendations for improved procedures and training for the client’s HR staff on data protection, but otherwise imposed no further sanctions.