Key takeaways
Supply chain exposure
Cyber incidents increasingly originate through third-party providers.
Response time matters
Early assessment and reporting can reduce regulatory risk.
Legal risk outlasts recovery
Litigation and investigations often continue for years.
October is Cybersecurity Awareness Month. In the next in our series of articles, we look at lessons from recent ransomware incidents. With an increasing number of ransomware incidents being reported, it seems there is no area of society that is not affected. The Cyber Security Breaches Survey 2025 reported that 43% of businesses and 30% of charities had reported having experienced a cyber security breach or attack in the previous 12 months.
Whether it is our favourite retailers having to deal with cyber incidents which affect payment systems or healthcare services providers’ inability to provide key services, the number and intensity of cyber attacks is increasing.
1. Cyber incidents are now supply-chain risks
Many recent attacks have demonstrated that an attack on a service provider can have significant downstream consequences for customers and users. This is reflected in the proposed focus on ‘critical suppliers’ in the Cyber Security and Resilience (Network and Information Systems) Bill.
2. Governance matters as much as technology
Recent incidents continue to show that cyber events frequently originate from weaknesses in access controls, authentication processes, supplier management or human error, rather than sophisticated technical vulnerabilities.
3. The first 72 hours are critical
The key issues when responding to a cyber-attack are containment, appropriate response and recovery. Rapid incident assessment is a must, escalation internally (and where appropriate externally) and reporting are also vital. The proposed Bill would introduce significantly tighter notification obligations, requiring organisations to be increasingly prepared before an incident occurs with notification times to regulators, where they have the potential to cause significant impacts, with initial notification within 24 hours and a fuller report within 72 hours for certain regulated entities and reportable incidents.
4. The attack may end, but the legal fallout continues
Organisations affected by ransomware incidents frequently face consequences that extend well beyond the technical recovery phase. Regulatory investigations, data protection issues, contractual disputes, shareholder scrutiny and follow-on litigation can continue for months or even years after an incident has been contained. Recent ransomware incidents illustrate that the consequences often outlast the technical response by a considerable margin.
Where personal data is affected, organisations must report personal data breaches to the Information Commission without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Depending on the sector and applicable regulatory framework, organisations may be expected or encouraged to notify the National Cyber Security Centre (NCSC), particularly where assistance with incident response is required or where the incident affects nationally significant services
Contractual exposure can be equally significant. Service outages, data loss and security failures may give rise to claims for breach of contract, disputes concerning limitation and exclusion clauses, and scrutiny of supplier security obligations. As a result, legal teams should be involved from the outset of incident response planning and execution.
Privilege should be considered from day one. Organisations experiencing a significant cyber incident should consider at an early stage whether communications, forensic investigations and incident reports may attract legal advice privilege or litigation privilege. Early involvement of legal advisers can assist in preserving privilege where appropriate and managing subsequent regulatory or litigation risks.
5. Resilience is becoming a regulatory expectation
The direction of travel is clear. Regulators increasingly expect organisations to demonstrate preparedness, supplier oversight, business continuity planning and effective cyber governance rather than simply reacting after an incident occurs. This means:
regularly carrying out tests on IT systems
having security controls regularly reviewed and updated
detailed incident response plans and disaster recovery/business continuity plans in place
training all staff on cyber security risks
ensuring cyber security standards operate throughout your supply chain via strengthened contractual arrangements
reviewing cyber insurance arrangements to assess coverage for incident response costs, business interruption losses, third-party claims and, where legally insurable, regulatory liabilities (fines and penalties).
Find out more about our Commercial Disputes expertise or contact us today to discuss how we can support you.
