Police warn small firms as grudge hacker is jailed

Small businesses have been warned to raise their awareness of internal IT security threats and tighten exit procedures for...

Small businesses have been warned to raise their awareness of internal IT security threats and tighten exit procedures for temporary staff following the conviction of a hacker for deleting business-critical data.

A computer engineer received an 18-month prison sentence last week for hacking into a firm's computer systems and wiping data following an argument over an unpaid bill for £75.

In what is believed to be the first such prosecution in the UK, Stephen Carey, 28, was jailed for attacking Sussex-based sheet metal firm RP Duct Work after the company refused to pay him for upgrading its computer systems. The firm said the work was unsatisfactory.

Carey gave himself unauthorised remote access and later deleted three years' worth of drawing files, causing up to £50,000 worth of damage and forcing the company to shut down its computer systems.

RP Duct Work refused to comment on the matter. "We just want to forget about it," said a spokesman for the firm.

Detective constable Mark Castle of Sussex Police, who led the investigation, said that although the police were able to recover the information it was in "an unworkable state" as all the files had been taken from their relevant folders and directories and jumbled together.

The incident has raised the issue of poor security practices in small businesses and of how important it is to back up data effectively. "The big lesson here is to enforce a strict, daily off-site back-up regime with at least two people responsible for it and to monitor any remote access to systems very closely," said Ed Wilding, of computer forensic investigations consultancy Datagenetics International.

Wilding said the case was "pretty much a first" in the UK and it raised the need for companies, especially small-and medium-sized enterprises, to pay more attention to the threat of malicious acts and to monitor employee exit procedures and contract staff more closely.

Police working with BT traced the crime trail back to Carey's PC by identifying his phone number. Carey had used it on nine separate occasions to connect to the firm's analogue data line, used in the attack.

"[Carey] tried to cover his tracks by reinstalling his operating system but we still found footprints within the system using forensic programming," said Castle.

Read more on IT for small and medium-sized enterprises (SME)