Blog Post

Over half of UK Energy Suppliers were targeted by hackers last year claims new report

Richard Simmonds • May 19, 2021

A new report released by Veritas Technologies has shown that over half of the UK’s utility companies suffered a cyber attack in 2020, with energy suppliers making up a sizeable chunk of those targeted.

An underreported threat

Cybersecurity has been an issue for companies in all sectors for many years now and despite there being more education and companies offering services to reduce the threats than ever, hackers are still having a high success rate.

The report from Veritas shows that Ransomware attacks are the biggest threat to utility companies in the UK due to the massive disruption they create.

According to more than half of the IT decision-makers surveyed in the report, their business has been hit by at least one cybersecurity incident in the past 12 months.

This figure is in stark contrast to data from Ofgem who recently confirmed that not one energy supplier has come forward to officially report a data breach following an incident.

This suggests that energy suppliers are either afraid of the consequences and possible punishment by the regulator of reporting such a breach or are deliberately keeping quiet to avoid any negative headlines.

This attitude is not helpful to the wider industry as the true scale of the cybersecurity issues in the sector cannot be accurately judged or prepared for.

The lack of reporting to the regulator suggests that the number of cybersecurity incidents in the UK energy sector is probably far higher than we realise.

Also read: Not one energy supplier has officially reported a cyber-attack to Ofgem despite numerous hacks says Sky News investigation

Energy Suppliers are most at risk

Energy supply companies need to realise that they are a prime target for hackers due to the sheer amount of data they process and utilise. They are the keepers of thousands of customers private records including financial data that are prized by nefarious actors.

Energy suppliers also top the Cyber Threat Ranking charts with the latest chart showing that the energy sector experienced median losses of over £100,000 in 2019. With the Covid-19 pandemic and the move to working from home for large swathes of employees in the sector, this figure was likely even higher in 2020.

Also read: Energy Supply companies most vulnerable to cyber-attack says new report

More needs to be done

64% of those IT professionals surveyed said that their organisation’s approach to dealing with cyber incidents could be improved either through increased budgets or via more leadership from the boardroom.

Another finding was that 88% of IT leaders agreed that the energy sector still hasn’t moved the vast amounts of data it holds to the cloud where it can be better protected.

“It’s very concerning those organisations in this sector are not taking ownership of protecting their own data in the cloud, despite the majority of IT leaders realising the value of data backups and signalling towards the necessity of unified backup solutions,” said Barry Cashman, Regional Vice President UK & Ireland at Veritas Technologies.

Also read: Busting the Cybersecurity Myths in the Energy Sector

Concerns over data responsibility

Misconceptions around data responsibility were also highlighted as being alarmingly rife across the sector with 88% of respondents saying that their organisation leaves the responsibility of backing up data to their cloud service provider. This means that energy companies are leaving themselves vulnerable and potentially their data exposed to hackers.

“Most cloud provider contracts usually place data management responsibility on customers. So, it’s very concerning that organisations in this sector are not taking ownership of protecting their own data in the cloud, despite the majority of IT leaders realising the value of data backups and signalling towards the necessity of unified backup solutions,” added Cashman.

“Whether they realise this discrepancy or not, it’s clear that businesses have to take more accountability for the protection of their data. And this must start with visibility – if you don’t know what data you have, how can you protect it? In an era where cyber-attacks are becoming more sophisticated and companies are increasingly under the regulatory microscope, businesses can’t afford to fall at the first hurdle.”

Another interesting finding is that 97% of the IT leaders surveyed believe that regulations are making data management and digital transformation harder to achieve despite the government and industry urging increased digitisation of the sector to help achieve climate targets.

Are you looking to join the energy supply market?

Dyball Associates gives energy companies the option to enter the UK market by purchasing an off-the-shelf supply business or by using our energy market consultancy services to create a new one. We specialise in both gas and electricity market entry and draw on over 25 years of experience to deliver the optimum route to market.

UK Energy Market Entry