BBC, Boots and BA see employee data hit in cyberattack

Employers including the BBC, Boots and British Airways have been affected by a cyberattack that may have seen hackers steal employees’ personal data including national insurance numbers, dates of birth and home addresses.

Last week, hackers from the ransomware group Clop stole data from users of the MOVEit Transfer file-sharing tool.

One of the firms that have been affected is Zellis, which provides payroll services to a number of UK employers. According to reports, eight Zellis customers have seen their data compromised.

Zellis said in a statement: “We can confirm that a small number of our customers have been impacted by this global issue and we are actively working to support them. All Zellis-owned software is unaffected and there are no associated incidents or compromises to any other part of our IT estate.

“Once we became aware of this incident we took immediate action, disconnecting the server that utilises MOVEit software and engaging an expert external security incident response team to assist with forensic analysis and ongoing monitoring. We have also notified the ICO, DPC, and the NCSC in both the UK and Ireland. We employ robust security processes across all of our services and they all continue to run as normal.”

The BBC said it did not believe its employees’ bank details had been stolen, although employee ID numbers and national insurance numbers were compromised.

BA said it has reported the incident to the Information Commissioner’s Office. It said in a statement: “We have been informed that we are one of the companies impacted by Zellis’ cybersecurity incident which occurred via one of their third-party suppliers called MOVEit. Zellis provides payroll support services to hundreds of companies in the UK, of which we are one.

“This incident happened because of a new and previously unknown vulnerability in a widely used MOVEit file transfer tool. We have notified those colleagues whose personal information has been compromised to provide support and advice.”

A Boots spokesperson said: “A global data vulnerability, which affected a third-party software used by one of our payroll providers, included some of our team members’ personal details.

“Our provider assured us that immediate steps were taken to disable the server, and as a priority we have made our team members aware.”

The National Cyber Security Centre said it was working to fully understand the impact of the MOVEit cyberattack on the UK.

“The NCSC strongly encourages organisations to take immediate action by following vendor best practice advice and applying the recommended security updates,” it said.

MOVEit’s software maker Progress Software Corporation has made fixes available since it discovered the vulnerability on 28 May.

Zellis was formed following Bain Capital’s acquisition of the UK and Ireland division of NGA HR in 2018, which was part of the larger company Northgate Information Solutions.

Latest HR job opportunities on Personnel Today

Browse more human resources jobs