When small business owner Sarah* returned from a lunch break, everything seemed normal. But logging back in to her computer, she realised her company had fallen victim to a cyberattack.
“Everything happened so fast. I looked for a file, but it was blank. There was nothing behind it,” she says. “I could see all my files on my computer going one by one, so I tried to shut everything down but it was too late.”
The attack, which was later traced to an infected ad on a website, took everything. The company had no idea what invoices had been sent out, or what was due to be paid. Planned work schedules were also wiped out, leaving the company paralysed.
“I thought I was going to have a mental breakdown. I remember my dad saying to me ‘just breathe’,” she says.
Then came the ransom demand. To get the files restored, the fraudsters wanted to be paid – and it had to be in bitcoin. As a small company, there was no in-house IT staff to take the lead, and Sarah admits she had no experience of dealing with an issue like this.
No one seemed to want to take on the problem, but the company eventually found a security expert who was willing to help. They took a gamble and paid the ransom; once the hackers had been paid, the files were quickly returned. It took a weekend to sort through everything with the help of the security company, but eventually all the data was reinstated.
Sarah’s story may be a familiar one to businesses across Ireland. Data published by insurance broker Gallagher and the Centre for Economics and Business Research in July found as many as two-thirds of Irish businesses have been hit by at least one cyberattack in the past year. Over a third suffered more than three attacks in the 12-month period.
The costs varied. Thirty per cent said they had incurred legal costs; a similar percentage found their revenue was impacted. More than 20 per cent were fined by the regulator, and almost a third were unable to serve customers in the downtime following the incident.
Cost
It is hard to put an exact figure on cybercrime in Ireland. Much of it flies under the radar, with many companies reluctant to publicise the incidents for fear of damaging their reputations. But as more regulations around cyber resilience and data privacy are introduced – GDPR, DORA, the European Cyber Resilience Act, among others – they may be obliged to come forward.
How companies react is as important these days. “You won’t be judged for being the victim of a cyberattack but you might be judged by how you react,” says security consultant Brian Honan.
[ After the SuperValu cyberattack, might your smart fridge be the next target?Opens in new window ]
He says it is not a matter of if companies will be attacked, but when. “It is the same as in the physical world: companies are likely to become victims of crime, be that break-ins or whatever else,” he says. “There shouldn’t be a victim-blaming concern here. The key thing is being able to respond in a timely manner, deal with the issue and communicate cleary with stakeholders. That is what companies need to be preparing for.”
As Covid forced a rapid shift in the digitalisation of businesses and remote work has become the norm rather than the exception, so too have the risks for companies risen. Add in the advent of artificial intelligence – or superintelligence, depending on how you market it – and the risks facing companies are suddenly magnified. Sometimes, it is merely the wrong place, wrong time for the victim.
“It is rare that we see a targeted attack. What is often happening is that companies are victims of a bigger attack that is aimed at a weakness in software,” Honan says.
The speed of the attacks are also picking up pace, as are the scale of them. That was brought home this week with the cyberattack that hit grocery retailers across Europe, including in Ireland.
For the staff of Supervalu, it may have taken a while to grasp the full extent of the problem. Early morning alarm call-outs in retail are nothing too unusual; in some cases, they are false alarms that need nothing more than a cursory check.
But in the early hours of Monday morning, it became quickly apparent that the problem was a serious one. Across 13 Supervalu stores, refrigeration units showed abnormal temperature readings. The monitoring system in place to pick up on such issues had worked effectively, alerting managers to the emerging situation and allowing them to take swift action.
The problem could have been much worse. A spokesman for the company said it was a particular type of refrigeration unit that was impacted, which meant the majority of the 228 stores in the Supervalu network escaped. But for those who were severely affected – Lucan, Blanchardstown, Bray, Waterford – the cost of the incident could run into thousands of euro. Unable to guarantee that food had been stored at correct temperatures, the retailer had to dump stock, leading to rows of empty shelves.
[ SuperValu cyberattack reminds us that nobody is immuneOpens in new window ]
It would take days for things to return to normal, with the precarious nature of food supply chains exposed in the process. Supermarkets work to keep food waste to a minimum by operating a “just-in-time” model for some stock that sees orders placed only when needed rather than keeping large back stocks of items just in case.
But with an incident of this nature, that meant some stock would take time to replenish.
The incident should serve as a warning shot, not just to the food retail business but to the wider business community.
Badly disrupted
Last year, Marks and Spencer found its business badly disrupted by a major cyber incident that left it unable to sell some of its products online for weeks. Jaguar Land Rover was also hit by a major attack, considered one of the most economically damaging in British history with an estimated cost of £1.9 billion (€2.3 billion) to the economy.
The company was forced to shut down automated production lines across its factories for five weeks, costing it £196 million directly and impacting thousands of businesses across the supply chain.
Closer to home, Jones Engineering was hit by a major ransomware attack in 2021, with hackers demanding millions for the return of its data. The company did not pay the ransom, instead bringing in outside security experts to restore its systems. That was closely followed by the attack on the HSE that took down computer systems in the health system, disrupted appointments and services, and saw the health data of thousands of people exposed.
There is a common thread with the attacks: social engineering and compromised credentials feature strongly. Workers are increasingly on their guard to avoid falling victim.
But even the most diligent of people can be caught out. John* found his email account taken hostage when he opened a link that came from a colleague. What he didn’t know was that the colleague had also fallen victim to a scam and had their email account taken over. “The first thing I did was check the address was genuine,” he says. “I wondered why they were sending me an email that AI had clearly been used to write. But I was skimming it and clicked the link. As soon as I did it, I realised what had happened.”
He immediately alerted the in-house IT staff, who had everything locked down within 20 minutes. But in that short space of time, hackers had managed to get into his email account and send the same message to all his contacts in an effort to dupe them. What he didn’t realise until the following day was that they had also implemented rules on his email account to bypass his inbox, feeding all the email into another folder.
Hundreds of messages were sent out in the 20-minute window. The hackers even replied to some who had messaged back to ask if the message was genuine.
“It was the first time any of us got caught out because it looks like it was from a colleague,” he says. “We did all the normal checks you would do, and when we realised what had happened we were straight on it.”
It is a common tactic that industry watchers are noting.
“Identity is becoming the new perimeter. Previously, a lot of the focus was on trying to secure your network, but increasingly attackers are targeting individuals to gain access to their digital identities, credentials, privileged accounts, and ultimately end up logging in rather than breaking in to your platforms,” says Stephen O’Keeffe of PwC. “Ransomware remains a big concern, and while originally it was about encrypting systems and causing disruption, increasingly there is a data theft component to it now.”
So where do businesses turn for help? Ireland has a cluster of big-name cybersecurity companies with their European bases here, such as Trend Micro, Fortinet, Malwarebytes and SolarWinds. But there is also an expanding home-grown sector, providing a launch pad for new enterprises, with companies such as Tines, Siren, UrbanFox and Cytidel going global from Ireland. According to Enterprise Ireland, there are 140 “pure play” cybersecurity companies located here, both Irish and foreign-owned.
In 2024, there were more than 8,100 cybersecurity professionals employed in Ireland. It is an area that seems destined to grow, even as AI takes over some of the load.
AI is also playing an outsized role in stoking fears. When the PHP vulnerability was discovered recently, it was down to AI. The flaw in the scripting language, which is used by a significant number of websites on the internet, had been present for a decade, escaping detection by human reviewers. But AI unearthed it, prompting immediate action from website owners who had to patch systems urgently.
AI-fuelled wave
There are fears of an AI-fuelled wave of sophisticated attacks, and it is colouring views of the technology as a whole. A survey conducted in September by technology consultants Expleo found that more than half of Irish business leaders are concerned about the cybersecurity risks posed by the technology, while 29 per cent said their opinion has been negatively impacted by their inability to successfully address cybersecurity and data protection risks.
That view has been driven in no small part by the AI companies themselves. In August, an open letter signed by some of the major players in AI – OpenAI, Google, Microsoft, Anthropic – and cybersecurity and financial firms warned that an AI-driven wave of cyberattacks was on the way. Organisations have a narrow window to defend themselves, the letter warned.
We might not be there yet, but AI is playing a role. “I can honestly say I have never seen an attack where AI is the key element behind it,” Honan says. “But we are seeing attackers become more efficient and effective by using AI.”
[ Could the Australian health service website hack happen in Ireland?Opens in new window ]
That includes using AI to craft more convincing phishing emails, or reverse engineering software patches to launch attacks on systems that may have yet to shore up their defences. The window to patch these flaws is getting smaller, and companies need to prepare for more frequent software updates as both sides of the business use AI to stay a step ahead.
EY’s Puneet Kukreja compares leaving unpatched devices on a company network to a broken window in your home. “They don’t need to get to your core financial crown jewel assets to bring you down. They can simply go in and attack the lowest hanging fruit,” he says.
The problem though is identifying the low-hanging fruit. In some cases, the affected systems are not in the control of the companies that suffer the consequences but are a third-party service provider.
This is where a resilience and recovery plan can help mitigate some of the worst effects, to help identify the risks and also to minimise the damage.
“Organisations increasingly recognise that they cannot prevent every incident. So their attention is shifting toward detection, containing and business continuity,” PwC’s O’Keefe says. “It isn’t a matter of preventing every attack. It is how well you operate through and recover from one.”
*Names have been changed