Rewterz Threat Update – HR Company SD Worx Shuts Down UK Payroll And HR Services Due To Cyber Attack

Severity

High

Analysis Summary

SD Worx, a leading HR and payroll management firm, became the victim of a cyber attack that led to its IT systems being shut down in the UK and Ireland services. SD Worx is a Belgian-based European HR and payroll management provider that serves 5.2 million employees for over 82,000 companies. The company has a team of over 7,000 HR professionals that are dedicated to providing secure, reliable HR and payroll services to its clients.

Being a full-service HR and payroll provider, the company handles a lot of confidential information on behalf of its clients’ workers. The data may contain tax information, government ID numbers, addresses, complete names, birth dates, phone numbers, bank account numbers, employee evaluations, and more, in accordance with the general conditions agreement of the firm.

According to the firm, “Our security team has discovered malicious activities in our hosted data center last night. We have taken immediate action and have preventively isolated all systems and servers to mitigate any further impact. As a result, there is currently no access to our systems, which we deeply regret of course,” notification sent by the company to UK and Ireland customers. 

The company did not disclose the nature of the attack or whether or not there was a data breach. Currently, the company’s portal for UK and Ireland is reachable again.

SD Worx conducts an investigation to assess the situation and reassure that they have confirmed that it is not a ransomware attack and that there is no evidence of data compromise at this time.

“It goes without saying that we are handling this with the highest priority and that we are working very hard on a solution to give you access to our systems again. We will keep you informed about the further status,” the company said.

Preemptively isolating their systems is a good measure to prevent any further potential impact and to properly assess the threat. It is also important for SD Worx to keep their clients and their employees informed about any updates or developments regarding the incident.

It is worth noting that even if there is no evidence of data compromise at this time, SD Worx should continue to monitor their systems and remain vigilant for any signs of malicious activity. They should also take steps to further strengthen their security measures to prevent similar incidents from occurring in the future.

Recommendations

Here are some of the best practices and recommendations to help safeguard your organization against such threats:

• Implementing strong cybersecurity measures: This can include using strong passwords, implementing multi-factor authentication, regularly updating software and systems, and using firewalls and antivirus software.
• Application hardening: Implement security controls at the application level to protect against common types of attacks, such as SQL injection, cross-site scripting (XSS), and buffer overflows. This can include measures like input validation, parameterized queries, and limiting the use of privileged accounts.
• Application assessment: Regularly assess the security of applications to identify vulnerabilities and risks. This can include techniques like penetration testing, vulnerability scanning, and code review.
• Regularly backing up important data: This can help to minimize the damage in the event of a successful cyber attack.
• Implement a DDoS mitigation strategy: Develop a comprehensive plan to identify, respond to, and recover from DDoS attacks. This includes establishing a communication protocol, coordinating with your IT team and external partners, and ensuring that all stakeholders are aware of their roles and responsibilities during an attack.
• Leverage cloud-based DDoS protection services: Engage the services of a reputable cloud-based DDoS mitigation provider, which can absorb and filter out large volumes of malicious traffic before it reaches your network.
• Maintain sufficient bandwidth: Ensure your organization has adequate bandwidth to handle sudden traffic surges during an attack. This can help to mitigate the impact of DDoS attacks on your network and maintain service availability.
• Conducting regular security assessments: This can help to identify vulnerabilities and risks that need to be addressed.
• Increasing employee awareness and training: This can help to raise awareness about the latest cyber threats and best practices for staying safe online.
• Implementing network segmentation and access controls: This can help to limit the impact of a potential breach and prevent attackers from moving laterally through the network.
• Employ geo-blocking: If your organization does not require traffic from specific countries or regions, consider implementing geo-blocking to restrict access from those locations, reducing the potential attack surface.
• Create a robust incident response plan: Develop a detailed incident response plan that outlines the steps to be taken in the event of a DDoS attack. This should include identifying the key personnel responsible for managing the incident, as well as external partners, such as your Internet Service Provider (ISP) and DDoS mitigation service provide

Impact

• Service Disruptions
• IT Systems Shutdown