Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Personnel Today

Register
Log in
Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Data protectionPayroll softwareLatest NewsPayroll

Employers hit by payroll cyberattack receive ultimatum

by Jo Faragher 7 Jun 2023
by Jo Faragher 7 Jun 2023 Employers are fearful that personal payroll details may have been stolen in the attack
Shutterstock
Employers are fearful that personal payroll details may have been stolen in the attack
Shutterstock

Employers including the BBC, Boots and British Airways have been issued with an ultimatum by a cyber-crime gang based in Russia after their data was stolen in a cyberattack this week.

The Clop group posted a notice on the dark web warning that it would publish the stolen data – which may include employee payroll details – after they managed to hack into file sharing tool MOVEit.

In the hack, the group were able to access data including national insurance numbers, dates of birth and home addresses. One of the companies affected by the hack was Zellis, which provides payroll services to a number of UK employers.

Data breaches

Dozens of employers affected by Capita data breach

Council publishes staff salaries online in error

Payroll giant SD Worx hit by cyberattack

Zellis has confirmed that eight organisations had data stolen as a result. Once it became aware of the cyberattack, it disconnected the server that uses MOVEit and engaged an external security incident response team.

In a blog post in broken English, Clop has given the companies affected until 14 June to email, or the stolen data will be published. This post confirmed this was the group behind the hack, after Microsoft said earlier this week it suspected Clop was to blame.

The group is thought to be based in Russia, and is reported to run a “ransomware as a service” group, hiring out cyberattack tools so attacks can be carried out from anywhere.

It said it would not publish any data from government, city or police services: “Do not worry, we erased your data, you do not need to contact us. We have no interest to expose such information.”

The following companies have all so far indicated that data may have been stolen: BBC, British Airways, Aer Lingus, Boots, the Nova Scotia government in Canada, and the University of Rochester in New York state.

The BBC said yesterday that it was aware of the data breach and was working closely with Zellis to investigate the extent of the breach, while BA said it had notified colleagues whose personal information may have been compromised to “provide support and advice”.

The employers affected are being urged not to pay up if the hacking group demands a ransom.

Steve Herbert from consultancy Partners& argued that HR professionals should get more involved in assessing risk and protecting organisations against such attacks.

He said: “Cyber security experts often point to the ‘human element’ as the inconsistency which – deliberately or accidentally – enables criminals to find an access route into their employer’s computer systems. And, although this latest attack doesn’t appear to be the result of employee actions, it has nevertheless led to the stealing of sensitive employee data as the ultimate objective of criminal activity.

Sign up to our weekly round-up of HR news and guidance

Receive the Personnel Today Direct e-newsletter every Wednesday

OptOut
This field is for validation purposes and should be left unchanged.

“It follows that employees can be the catalyst for such an attack and/or the victims of it, and this makes cyber security very much an HR issue. HR experts may therefore need to become far more involved in implementing policies, procedures, and insurances to minimise these risks across their entire workforce.”

HR business partner opportunities on Personnel Today


Browse more HR business partner jobs

bespoke email
Jo Faragher

Jo Faragher has been an employment and business journalist for 20 years. She regularly contributes to Personnel Today and writes features for a number of national business and membership magazines. Jo is also the author of 'Good Work, Great Technology', published in 2022 by Clink Street Publishing, charting the relationship between effective workplace technology and productive and happy employees. She won the Willis Towers Watson HR journalist of the year award in 2015 and has been highly commended twice.

previous post
Oxfam video depicting ‘JK Rowling’ with Terf badge criticised
next post
How employers can support staff with adenomyosis

You may also like

‘Polygamous working’ is a minefield for HR

14 May 2025

M&S pauses hiring as it deals with cyber...

2 May 2025

Remote working may have triggered jump in employee...

17 Apr 2025

GMC ‘erases’ records on doctors who change gender

21 Feb 2025

What’s HR’s role in ethical AI adoption?

6 Feb 2025

Top 10 HR questions January 2025: TUPE employee...

4 Feb 2025

LinkedIn accused of using user data to train...

23 Jan 2025

Deliveroo, Just Eat and Uber face calls for...

20 Jan 2025

EU AI Act: What HR needs to know

8 Jan 2025

AI Act comes into force in EU: how...

2 Aug 2024

  • 2025 Employee Communications Report PROMOTED | HR and leadership...Read more
  • The Majority of Employees Have Their Eyes on Their Next Move PROMOTED | A staggering 65%...Read more
  • Prioritising performance management: Strategies for success (webinar) WEBINAR | In today’s fast-paced...Read more
  • Self-Leadership: The Key to Successful Organisations PROMOTED | Eletive is helping businesses...Read more
  • Retaining Female Talent: Four Ways to Reduce Workplace Drop Out PROMOTED | International Women’s Day...Read more

Personnel Today Jobs
 

Search Jobs

PERSONNEL TODAY

About us
Contact us
Browse all HR topics
Email newsletters
Content feeds
Cookies policy
Privacy policy
Terms and conditions

JOBS

Personnel Today Jobs
Post a job
Why advertise with us?

EVENTS & PRODUCTS

The Personnel Today Awards
The RAD Awards
Employee Benefits
Forum for Expatriate Management
OHW+
Whatmedia

ADVERTISING & PR

Advertising opportunities
Features list 2025

  • Facebook
  • Twitter
  • Instagram
  • Linkedin


© 2011 - 2025 DVV Media International Ltd

Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+