Critical UK infrastructure a ‘hostage of fortune’ to ransomware

There is a high risk of a genuinely catastrophic ransomware attack occurring against a critical national infrastructure (CNI) target in the UK at any moment, with the lack of planning for such an incident at Westminster meaning that the entire country is essentially being held “hostage to fortune”, the Joint Committee on the National Security Strategy has warned.

In the report A hostage to fortune: ransomware and UK national security, which has been over 12 months in the making, the committee, which spans both houses of Parliament, warned that despite solid work from the government and the National Cyber Security Centre (NCSC) on cyber resilience, “large swathes” of the UK’s CNI remained highly vulnerable, with many operations relying on legacy IT systems, particularly in healthcare and local government. The report also found that supply chains were particularly vulnerable, describing them as the “soft underbelly” of CNI.

As a result of this, a coordinated and targeted ransomware attack could take down large parts of the UK’s public services infrastructure, causing severe damage to the economy and to everyday life for millions of people.

It cited a number of recent attacks that have demonstrated the ongoing vulnerability of Britain’s public services, including the infamous LockBit hit on Royal Mail in January and February of 2023, which left services paralysed for weeks; attacks on local authorities such as Redcar and Cleveland Borough Council in early 2020, the London Borough of Hackney later that same year; and the 2022 incident at medical software supplier Advanced Software, which wrought havoc across the NHS.

“There is a high risk that the government will face a catastrophic ransomware attack at any moment, and that its planning will be found lacking. If the UK is to avoid being held hostage to fortune, it is vital that ransomware becomes a more pressing political priority, and that more resources are devoted to tackling this pernicious threat to the UK’s national security,” the report said.

“In 2020, this committee examined the government’s preparations for the Covid-19 pandemic, considering what it could teach us about how to prepare for a known risk with a high potential impact. We found that the government had not prepared adequately for a pandemic, despite knowing that there was an increasing chance of such a scenario occurring.

“The government is at risk of making the same mistake again: it knows that the possibility of a major ransomware attack is high, yet it is failing to invest sufficiently to prevent catastrophic costs later on. There will be no excuse for this approach when a major crisis occurs, and it will rightly be seen as a strategic failure.”

The committee has particularly harsh words for the Home Office – which leads on ransomware as a national security risk and policy issue – saying that former home secretary Suella Braverman had “showed no interest” in the topic, preferring instead to prioritise issues such as illegal migration and small boats. It called for responsibility for ransomware to be transferred to the Cabinet Office, working with the NCSC and the National Crime Agency (NCA), and ultimately overseen by the deputy prime minister, currently Oliver Dowden.

Jamie MacColl, cyber security research fellow at the Royal United Services Institute (RUSI), a thinktank, who contributed extensively to the committee’s evidence-gathering exercise, commented: “The inquiry report is one of the clearest articulations to date of the challenges posed by ransomware. Although it is rightly critical of the UK government’s record on ransomware, it is important to remember that other national governments have also struggled to find ways to meaningfully shift the cost-benefit calculus of Russian ransomware groups, who continue to wreak havoc.”