Why summer leave demands heightened password hygiene

In 2025, just over four in ten UK businesses (43%) reported experiencing a cyber security breach or attack during the previous 12 months, with that figure rising to 67% in medium sized firms and 74% in large ones. Phishing remained the dominant method of attack, affecting 85% of organisations that identified breaches.

Seasonal reductions in staff numbers, remote working and less oversight can allow small mistakes, such as reusing passwords, to have much bigger consequences. According to the Royal Institution of Chartered Surveyors, 27% of UK businesses were hit by a cyber attack in the past year, up from 16% the year before. These figures highlight the growing risk, particularly during periods with less supervision.

Use modern password standards and move beyond forced expiry

UK cyber guidance now discourages regular forced password changes unless there has been a suspected breach. This is because, when users are prompted to change credentials frequently, they often create weaker, predictable passwords, for example by simply adding a number or punctuation mark.

Instead, the National Cyber Security Centre (NCSC) recommends the use of longer passphrases made up of three random words, separated by full stops. These are both stronger and easier to remember than traditional passwords. The NCSC also advises organisations to adopt password managers and, where possible, passkeys. These tools can generate and store unique credentials securely, reducing the risk of password reuse or staff writing details down.

MFA

Multi factor authentication (MFA) remains one of the most effective ways to protect business critical systems. Yet despite its benefits, only around 40% of UK businesses have implemented MFA across all user accounts. Email accounts are especially vulnerable, as they can often be used to reset access to other platforms. Ensuring these are protected with MFA is considered a baseline measure by most UK security professionals.

Lock screens and devices immediately when unattended

An unattended device with an open screen is one of the easiest targets for opportunistic attacks or accidental misuse. Whether it is a visitor in the office, a contractor passing by or a well meaning colleague, leaving access open can result in emails being forwarded, data copied or malware being introduced via USB.

The Information Commissioner’s Office (ICO) advises that screens should lock automatically after two or three minutes of inactivity. Staff should also be trained to manually lock their devices every time they step away from their desks. This is especially important during summer when office routines may be more relaxed and the mix of people in the workplace can change.

Recent incidents show that even organisations with secure buildings can fall victim to social engineering or internal threats if unattended devices are left exposed. Automatic screen locking, combined with a strong culture of responsibility, helps reduce the risk significantly.

Ensure quick incident reporting when supervision is reduced

When teams are leaner, delays in reporting suspicious activity can allow small issues to spiral. For example, even a single phishing email that goes unreported could result in credential theft, malware infection or wider compromise of the organisation’s systems.

The ICO reminds organisations of their legal obligation to report serious personal data breaches within 72 hours. However, underreporting remains an issue. For example, a 2023 Cybsafe survey found that many employees still hesitate to report security issues, fearing they will be blamed or seen as incompetent. Some of them attempt to fix problems themselves, often making the situation worse.

Clear policies

Clear policies and non udgemental internal reporting procedures can also help. Businesses should reinforce the message that early reporting is vital, regardless of the perceived severity of the issue. When fewer people are available to detect problems, every employee becomes part of the security perimeter.

Vigilance essential

Major cyber attacks on well known UK retailers in early 2025 highlighted how attackers often exploit gaps in supervision. In one widely reported case, criminals impersonated staff during a helpdesk call to reset login credentials at a large national department store chain. Using publicly available information and a convincing pretext, they persuaded internal support teams to grant access to privileged systems. The attackers then used this access to infiltrate the company’s ordering and stock systems, causing widespread disruption to online deliveries, store stock management and customer services across the UK.

The NCSC has since updated its guidance to stress the importance of identity verification, particularly during periods when usual contacts may be away. Organisations should ensure that all staff know who to contact in case of a suspected breach and that backup procedures are in place when key individuals are on leave.

Proofpoint’s 2024 threat report showed a rise in phishing campaigns timed around bank holidays and summer breaks, many of which referenced internal systems or posed as absent executives. These tailored scams are more convincing and more dangerous when teams are under pressure or lacking oversight.

Promote a culture of year round accountable vigilance

It’s worth noting here that security does not begin and end with IT departments. In reality, everyone in the organisation has a role to play, particularly when fewer colleagues are present to notice if something goes wrong.

As Richard Horne, CEO of the NCSC, recently warned “businesses ignore advice at their peril,” thereby highlighting that even basic security measures can reduce insurance claims by over 90%. However, the latest government figures show that fewer than one in ten UK organisations are currently certified under Cyber Essentials, the UK’s official baseline standard.

The ICO and NCSC both emphasise that technical tools must be matched by behaviour and awareness. That includes locking screens, using secure credentials, escalating concerns early and understanding that cyber security is not someone else’s job.

What does this mean for your business?

A key takeaway here is that there’s no seasonal exemption from cyber threats. In fact, if anything, the summer period heightens the risk, as gaps in supervision and more flexible routines make it easier for poor habits to slip through unnoticed. For UK businesses, this is not just a matter of good practice but of operational resilience. Attacks timed during holiday cover or lean staffing can have a disproportionate impact, especially when response times are slower and reporting structures unclear.

The broader lesson is that culture really matters. Password policies, screen locking procedures and incident response plans are only effective when staff at all levels understand them and use them without hesitation. For security teams and senior leaders, this means investing in clarity and communication as much as in software or hardware.

UK regulators are already making expectations clear. With the ICO strengthening its stance on breach reporting and the NCSC repeatedly highlighting the need for accountability beyond the IT department, there is growing pressure on organisations to prove that cyber responsibility is being taken seriously throughout the business. That includes facilities managers, HR teams and anyone with access to systems or data.

What this means for UK businesses is a need to treat holiday periods not as downtime, but as a potential test of their internal defences. For insurers, regulators and supply chain partners, lapses in protocol will look less like an accident and more like a failure to plan. For customers and clients, the reputational damage from a breach can be immediate and lasting.

Avoiding that outcome does not require complex changes. It comes down to reinforcing a few non negotiables. Strong, unique passwords. Locked screens. Prompt reporting. And a shared understanding that good security is not a favour to the IT team but a safeguard for the whole organisation.

The post When the Boss Is Away… Don’t Let the Security Slip appeared first on Quayside Technical Services.

What is the ITC, and what is the complaint?

The International Trade Commission (ITC) is a US federal agency responsible for enforcing trade laws, addressing unfair trade practices, and protecting industries from harm. Although its remit typically covers trade related matters, it has increasingly expanded its oversight to include consumer protection, particularly in cases where corporate failings have broader implications for commerce and public interest.

In a recent formal complaint, the ITC alleged that GoDaddy violated Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive business practices. Despite marketing itself as a secure and reliable hosting provider, GoDaddy, according to the ITC, failed to live up to its claims, thereby leaving millions of customer websites vulnerable, resulting in multiple security breaches and significant data compromises.

The allegations in more detail

The ITC’s complaint paints a troubling picture of the lack of GoDaddy’s cybersecurity practices. It accuses the company of failing to implement even the most rudimentary safeguards to protect its hosting environment. Among the lapses cited by the ITC are the absence of essential measures such as multi factor authentication (MFA), proper asset inventory, and robust threat monitoring.

Specifically, the ITC’s complaint,published online, identified the following failings:

• No centralised asset management. As of 2020, GoDaddy had visibility over only 15,000 devices out of the approximately 450,000 in its environment.
• Irregular patch management. Despite a policy requiring critical updates to be applied within 30 days, GoDaddy relied on scattered teams to handle patches with no central oversight, leading to unpatched vulnerabilities across thousands of servers.
• Inadequate logging and monitoring. Security related events were inconsistently logged, making it difficult to investigate breaches or suspicious activity.
• Weak authentication practices. The company relied on username/password combinations without requiring MFA for privileged accounts until 2020, thereby exposing sensitive systems to unauthorised access.
• Network mismanagement. A lack of segmentation between shared hosting and other services enabled threat actors to move laterally within GoDaddy’s infrastructure.
• API insecurity. GoDaddy’s APIs, critical for managing customer data, used outdated protocols, such as plaintext credentials, leaving them highly susceptible to interception and exploitation.

A history of breaches and consequences

The ITC report also details several high profile security incidents that occurred under GoDaddy’s watch, starting back in 2019. The ITC alleges that these breaches highlight the tangible risks posed by the company’s inadequate security measures.

The 2019-2020 breaches

A breach in October 2019 saw attackers exploit vulnerabilities in GoDaddy’s infrastructure to move laterally into its shared hosting environment. Threat actors replaced critical server files with malicious versions, ultimately compromising customer and employee login credentials. Shockingly, these intrusions went undetected for six months until another, unrelated event in March 2020 prompted an external security audit.

During this time, attackers reportedly stole credentials for over 28,000 customer accounts and 199 employees, gaining administrative access to key systems. The breach also involved the theft of approximately 1,000 payment card details.

2021 WordPress API breach

In November 2021, GoDaddy discovered another breach targeting its Managed WordPress hosting service. This time, attackers exploited an exposed API, obtaining data for 1.2 million customers, including email addresses, private encryption keys, and login credentials for WordPress and database management tools. Evidence suggests the attackers used this access to plant malware and commit search engine optimisation (SEO) fraud, misleading visitors and search engines alike.

2022 malware resurgence

The most recent breach, in December 2022, saw the same threat actors return to exploit remnants of the 2019-2020 compromise. This time, attackers deployed malware that redirected visitors to customers’ websites to malicious destinations, such as phishing pages or explicit content. Despite the repeated nature of these attacks, the ITC alleges that GoDaddy failed to proactively detect the intrusion, learning of it only through customer complaints.

Impact on customers and the broader ecosystem

The consequences of GoDaddy’s alleged failings have been farvreaching. Small businesses that rely on its hosting services have endured significant disruptions, including compromised websites, stolen customer data, and tarnished reputations. Some customers have faced financial fraud or identity theft, while others have spent substantial time and resources remediating the damage caused by breaches.

The ITC’s complaint makes the point that these harms were entirely avoidable had GoDaddy employed widely available, low cost security measures. Also, it accuses the company of misleading customers by marketing its services as secure while failing to back these claims with appropriate protections.

GoDaddy’s response and the way forward

In response to the ITC’s allegations, GoDaddy has neither admitted nor denied the charges but has agreed to implement a comprehensive security overhaul. This includes creating a centralised inventory of its hardware and software, adopting Security Information and Event Management (SIEM) tools for real time threat detection, and enforcing MFA across all privileged accounts.

A spokesperson for the company stated: “We are committed to safeguarding our customers’ data and continually improving our security posture. Many of the measures outlined in the settlement are already underway.”

The settlement

Despite the gravity of the accusations and the scale of harm outlined in the ITC’s complaint, the settlement agreement struck with GoDaddy has left some questioning its adequacy. Under the terms of the proposed deal, GoDaddy must implement sweeping improvements to its cybersecurity practices. This includes undergoing regular, independent third party assessments of its security programme and adhering to a ban on making deceptive claims about its data protection efforts in the future.

Notably, the ITC has not imposed any fines but has warned that future violations could result in penalties of up to $51,744 per breach.

What’s next?

The ITC has opened the settlement for public comment, and its finalisation will mark a critical juncture for GoDaddy. The case serves as a cautionary tale for other companies, demonstrating the risks of neglecting cybersecurity in an increasingly hostile digital landscape.

What if you’re a business customer of GoDaddy’s?

For businesses that rely on GoDaddy’s hosting services, the revelations in the ITC’s complaint may understandably be a little unsettling. Many may now be questioning whether their websites or customer data were compromised in the breaches. Those who suspect they have been affected can review communications from GoDaddy, as the company has stated that it notified impacted customers following major incidents. Another option for businesses may be to engage independent security experts to audit their sites and data for any lingering vulnerabilities. Moving forward, customers will need to think carefully about whether GoDaddy’s promised security enhancements can restore their confidence or if alternative hosting providers may better meet their needs.

What does this mean for your business?

As one of the largest web hosting providers, GoDaddy holds a significant position of responsibility, safeguarding not only its customers but also the broader ecosystem of internet users who interact with its hosted websites. The ITC’s findings, therefore, paint a very concerning picture of allegedly some very basic and systemic failures in cybersecurity practices over several years, leading to serious breaches that have impacted countless businesses and their customers.

For GoDaddy, the settlement offers a chance to repair its reputation and demonstrate a renewed commitment to cybersecurity. Although the lack of financial penalties has been surprising to some, it appears to be more of a case of getting some swift remedial action rather than prolonged litigation. However, it is understandable that some stakeholders may view the resolution as lenient, given the scale of the alleged failings and the potential harm caused. The onus is clearly now on GoDaddy to follow through on its promises and implement the sweeping changes outlined in the settlement.

For businesses affected by the breaches, the road to recovery may be a long and complex one. While GoDaddy’s notification efforts and security improvements may offer some reassurance, the damage to customer trust and the potential for lingering vulnerabilities remain pressing concerns. Businesses should, perhaps, weigh the risks and benefits of continuing their reliance on GoDaddy and consider proactive steps to safeguard their operations, regardless of the hosting provider they choose.

This case serves as a wake up call for the entire tech industry, underscoring the need for vigilance in an era of evolving cyber threats. Basic security hygiene, while often viewed as a standard requirement, is essential to maintaining trust and preventing harm on a global scale. For organisations of GoDaddy’s stature, the stakes are even higher, as lapses in security can reverberate far beyond their own systems.

The ITC’s intervention, therefore, not only holds GoDaddy to account in some way but also sends a clear message to the industry: that data protection and cybersecurity are not optional. As businesses and consumers alike navigate the fallout, the hope is that this episode will lead to meaningful changes, not just for GoDaddy but for the industry as a whole, ensuring a more secure digital landscape for everyone.

The post GoDaddy Complaint Over Years of Poor Cybersecurity appeared first on Quayside Technical Services.

Managing privacy settings in your Microsoft 365 account can help protect your personal and business information. Properly configured privacy settings help ensure that your data is only accessible to those who are authorised and that your activities remain private. Here’s how to access and manage your privacy settings to enhance security and privacy:

The post Update Your Software and Drivers appeared first on Quayside Technical Services.

The Move To SaaS and Cloud 

In the rapidly evolving digital landscape, one of the key drivers enabling attackers to compromise an organistaion without needing to touch the endpoint or conventional networked systems and services is the increased reliance on cloud based services and software as a service (SaaS) applications, to drive efficiency and innovation. This shift, while beneficial, has also created new cybersecurity challenges for businesses, primarily due to the decentralisation of ‘digital identities’ and the interconnected nature of cloud services.

The SaaS Revolution and Its Impact on Security 

The proliferation of SaaS applications is a direct result of the digital transformation that has reshaped the business world. For example, companies can now be using hundreds, if not thousands of cloud applications to perform daily operations, from customer relationship management to financial operations. This shift is driven by the convenience and scalability of SaaS solutions, however it comes with inherent security risks.

The new risk that businesses are facing is that each application potentially serves as an entry point for malicious actors, and the interconnectivity between these apps can allow a breach in one service to cascade through to others.

Why Digital Identities Are The New Security Battleground 

As the traditional network perimeter dissolves, digital identities become the new security frontier. Put simply, a digital identity can be a user account created for services that someone in the business has signed up for using a username or email and password. More broadly, it can also mean other personal data used to identify and authenticate users online.

These digital identities, which provide access to a myriad of cloud applications, are now central targets for attackers. Securing them has become increasingly complex due to the sheer number of them that businesses may be using and their dispersion across various cloud platforms, each with its own security environment. This decentralisation not only makes consistent security policies harder to enforce but also increases the complexity of monitoring these identities for potential breaches.

How Attackers Are Exploiting Vulnerabilities in Cloud Identities 

Attackers have adapted to this new environment by developing sophisticated techniques to exploit vulnerabilities in cloud identities without ever touching the physical endpoints or traditional networked systems.

Examples of techniques include AiTM (Adversary in The Middle) phishing, SAMLjacking, and Oktajacking, all of which exploit weaknesses in the authentication processes and session management of cloud services.

AiTM phishing involves intercepting and manipulating real time data during a session to steal credentials or manipulate transactions. SAMLjacking and Oktajacking focus on manipulating Single Sign On (SSO) processes to gain unauthorised access.

Security stats now reveal increasingly that attackers are deliberately targeting cloud services as a way into organisations. For example, malware used to be one of the main threats, but CrowdStrike figures show that three out of four attacks last year were malware free, and that the targeting of cloud services has increased 110 per cent. This helps to illustrate why cloud identities are the new digital perimeter and that cloud apps and identities now give attackers the same result as old style attacks without them having to try and breach a network perimeter via the endpoint.

The Security Gap in Identity Management 

Despite advances in cybersecurity, it’s clear to see why many businesses are now vulnerable to identity based attacks. Traditional security measures like endpoint detection and response (EDR) systems and firewalls, for example, are less effective in a cloud centric world where applications are accessed primarily through web browsers. This gap is exacerbated by the reactive nature of many security strategies, which focus on mitigating threats after they have been detected rather than preventing them proactively.

What Does This Mean for Your Business? 

For UK businesses, their move to the cloud and the usage of a wide range and complicated combination of SaaS apps, digital identities, and the interconnection and decentralisation of these have meant that they are now vulnerable to networkless attack techniques, perhaps without realising it until now. The shift to cloud computing has not only expanded the attack surface but also highlighted the inadequacies of traditional security models in protecting digital identities. This means that UK businesses must now take a much closer look at the security of these identities as part of their overall cybersecurity strategy.

To mitigate the risks associated with networkless attacks, businesses should perhaps consider adopting a zero trust security model, which assumes that threats could be internal or external and verifies each identity and device continuously, regardless of their location. Additionally, enhancing visibility across all cloud services and implementing advanced security measures like multi factor authentication (MFA), behavioral analytics, and more sophisticated identity and access management (IAM) solutions could help.

In short, as these networkless attacks continue to evolve, UK businesses must be proactive with security, stay vigilant and adapt their security strategies. By understanding the vulnerabilities associated with digital identities and cloud services, and implementing security measures accordingly, businesses can safeguard their assets in the cloud era.

The post ‘Networkless’ Attacks? appeared first on Quayside Technical Services.

The attack, which uses a bug in Apple’s password reset feature, bombards the user’s phone with password reset requests and ‘Allow’ or ‘Disallow’ options. If the user eventually clicks on ‘Allow’ in an attempt to stop the many prompts, they receive a call from scammers pretending to be Apple Support, asking the user to verify a one time code in an attempt to gain access to the account and/or to sensitive user information.

So far, it’s understood that these attacks have been highly targeted at certain individuals and users should note that Apple Support will never call a user unless that user has specifically asked them to. It’s also been reported that turning on Apple Recovery Key for the account is a way to stop the multiple notifications generated by the scammers.

The post iPhone Users Targeted With Password Reset Scam appeared first on Quayside Technical Services.