Manchester police data breach a classic supply chain incident

Questions of responsibility in supply chain incidents

Coming in the wake of multiple other data security incidents affecting the UK public sector, resulting both from cyber attacks and insider error, Tom Kidwell, a former army and intelligence professional and co-founder of security consultancy Ecliptic Dynamics, said that the force could have done more to secure its information. 

“When thinking about cyber security, most organisations tend to focus on their own security, and hope that their suppliers and other organisations operating alongside them, are doing their jobs effectively. Unfortunately for the Greater Manchester Police, this seems not to have been the case,” he said.

“The reality is that law enforcement agencies and other public sector bodies are becoming an increasingly common target for attacks, not just because they often hold highly sensitive, and lucrative information, but also to cause disruption and chaos within the UK.

“It highlights again the need for having a robust understanding of your supply chain and ensuring they are accountable, particularly in areas which could leave you vulnerable. Managed service providers often have elevated levels of access to your systems and data, often more than your own staff. The assumption is they are taking as much diligence and care of your digital infrastructure as you are,” said Kidwell.

While GMP cannot be blamed for the initial cyber attack on its supplier, Rob Sheldon, a partner at data breach specialist law firm Fieldfisher, voiced similar sentiments.

“We don’t know the precise details here, but when an organisation in the UK/EU engages a supplier to provide a service and provides information about people to perform that service it is legally required to carry out due diligence checks on the supplier and to enter into a contract with the supplier.,” said Sheldon.

“The contract must meet certain minimum requirements including an obligation on the supplier to implement and maintain appropriate security measures and to notify the customer if its data is affected by a data breach.

Sheldon added: “Increasingly, customers look for contractual protection from suppliers against data protection breaches, including for breach of contract/law, including an obligation to pay the customer if a data-breach happens where the customer suffers damage as a result of the breach. 

“Often, customers will look for protection against claims from individuals affected by the data-breach, the costs incurred in managing the breach and regulatory fines arising from the breach.”