NFSP Reports Ransomware Attack After cPanel Vulnerability Exploited
Summary
The NFSP says attackers exploited a critical cPanel vulnerability in a ransomware attack that disrupted its website. The federation reported no data loss; the Post Office paused email exchanges and says its networks and applications show no compromise.
Key points
- The NFSP said it was targeted on April 30 after attackers exploited a critical vulnerability in cPanel software used by its web-hosting provider.
- NFSP CEO Calum Greenhow said the attackers demanded the release of files.
- The NFSP said its IT team found no data loss and that it reported the incident to the ICO.
- The Post Office paused inbound and outbound email and some interactions with the NFSP while the incident is investigated.
- The Post Office said branch operations were unaffected and it had identified no compromise of its networks or applications.
- The issue was still ongoing in the Post Office's June 2 update.
Article Details
- Victim Organization
- National Federation of Subpostmasters (NFSP)
- Victim Domain
- nfsp.org.uk
- Incident Type
- Ransomware attack following exploitation of a critical vulnerability in cPanel software used by NFSP's web hosting provider.
- Affected Records
- None reported; NFSP said its IT team confirmed that no data was lost.
- Operational Impact
- NFSP reported ongoing technical problems. The Post Office temporarily paused inbound and outbound email and some interactions with NFSP. The Post Office said branch operations were unaffected and that it had identified no compromise of its networks or applications.
- Ransom Or Extortion
- NFSP said attackers demanded the release of its files; no ransom amount or payment was reported.
- Claim Status
- confirmed
MITRE ATT&CK
People
Calum GreenhowNFSP CEO who described the ransomware attack and said it had been reported to the ICO; he also relayed the IT team's finding that no data was lost.Neil BennettPost Office CISO who notified subpostmasters that email between the Post Office and NFSP had been paused and later reported that the issue remained ongoing.