What the latest cyber incidents tell SMEs about third-party risk 

A series of cyber incidents reported in recent days show how an incident at a technology supplier can affect a business’s customer data, operations and reputation.

For growing SMEs, they raise practical questions about supplier oversight and how to be prepared for an incident.

ASOS confirmed on 6 October that it was investigating unauthorised activity involving third-party platforms used to communicate with customers, after users received an unauthorised push notification through its app.

It said names and contact details may have been accessed, although it didn’t believe payment-card information or passwords were affected.

Separately, the Financial Times reported that sensitive information belonging to clients of Goldman Sachs and Man Group had been compromised following a vulnerability in third-party software used by EY. Both firms said their own systems hadn’t been affected.

On 13 October, TFG London, owner of Hobbs, Whistles and Phase Eight, said a cyber attack had left some IT systems unavailable and prompted it to pause online orders while it investigated whether personal or sensitive information had been compromised.

H&M is also investigating a hacking claim, although it says it’s found no indication that its data has been breached.

Your suppliers form part of your cyber risk

Growing companies often add software and technology as they expand. This can improve efficiency but also creates dependencies that need to be understood and managed.

Supply chain guidance from the National Cyber Security Centre (NCSC) encourages organisations to understand where they depend on suppliers, including where they store or process sensitive information.

Passwords, access controls, phishing training and patching remain important. But even a business with strong internal defences can face an incident that began somewhere else.

Using a supplier doesn’t remove your responsibilities

If a supplier suffers a breach that involves your customers’ personal information, your business may still have obligations around data protection.

As a data controller, you must notify the ICO unless the breach is unlikely to put individuals’ rights and freedoms at risk. You must do this without undue delay and, where feasible, within 72 hours of becoming aware of the breach. You don’t need every detail before reporting – you can provide information in stages.

A supplier acting as your data processor must notify you immediately after becoming aware of a personal data breach. Agreeing a specific contractual deadline can help you meet your own obligations.

If a supplier processes personal data on your behalf, Article 28(3) of the UK GDPR requires a written contract covering matters including:

• processing on your documented instructions, confidentiality and security
• the use of sub-processors
• assistance with individuals’ rights, breaches and data protection impact assessments
• returning or deleting data when services end
• information and audit rights to demonstrate compliance

You must also choose processors that provide sufficient guarantees that they will protect personal data and meet the requirements of UK GDPR.

Assess the risks before introducing new technology

Before appointing a supplier or changing how you use a platform, consider whether you need a data protection impact assessment (DPIA).

A DPIA is needed if processing is likely to result in a high risk to individuals’ rights and freedoms. Not every supplier arrangement meets that threshold.

Where necessary, you should assess the processing, risks and safeguards, with appropriate assistance from your processor. If there’s still a high risk that you can’t sufficiently lower, you must consult the ICO before you begin processing the data.

Prepare your communications before an incident

The ASOS incident is interesting because the alleged attackers appear to have used a customer-facing communications channel themselves.

Customers may see screenshots on social media or receive information directly from an attacker before the business has established what happened. Silence creates risks, but so do premature reassurances.

Legal, technical and communications teams should work together to explain what they know, what remains under investigation and what customers should do.

Make sure your contracts and response plan work in practice

Senior managers need to understand where the business is exposed and be prepared to make decisions when the information available is incomplete.

• Supplier contracts should be useful when something goes wrong, not just when the service is running smoothly. Alongside the required data protection terms, they should set out clear requirements for security, responsibilities for notifying your business of any incidents, and expectations around co-operating with an investigation. They should also say clearly who will support recovery and customer communications, and who bears the associated costs.
• Consider whether the contract should include indemnities for specified losses arising from a supplier’s breach of its data protection or security obligations. Check liability caps and exclusions carefully – they may significantly limit the protection available. Contractual protection does not remove your responsibilities under the regulations.

A useful starting point is to check:

• which suppliers hold sensitive information or support critical operations
• who leads the response and makes reporting decisions
• how the business will operate if a critical platform becomes unavailable
• how you’ll contact customers if your usual channels are affected
• whether you have suitable cyber insurance, including cover for relevant incidents originating at suppliers

Cyber insurance can help with incident-response costs and business interruption, but cover varies.

Check whether your policy covers relevant supplier incidents, what exclusions and limits apply, and any security conditions you must meet. Make sure your response plan reflects the insurer’s notification requirements and any conditions on appointing advisers or incurring costs.

Our data protection and commercial lawyers can help you review supplier contracts, assess whether a DPIA is needed, clarify breach-reporting responsibilities and strengthen your incident-response procedures.