Employees at Boots, British Airways and the BBC have reportedly had their personal data compromised in a cyber-attack which may spread to companies the US.

According to a report from the FT, the hack was carried out by a Russian-speaking criminal gang and exploited a previously unknown weakness in software called MOVEit, used by payroll provider Zellis. The motive behind the attack is unclear.

The software is used by almost half of FTSE 100 companies in the UK.

In a statement Zellis said confirmed the attack and said it was working with customers who had been impacted by the issue. It added that all Zellis-owned software is unaffected and there were no associated incidents.

“Once we became aware of this incident we took immediate action, disconnecting the server that utilises MOVEit software and engaging an expert external security incident response team to assist with forensic analysis and ongoing monitoring. We have also notified the ICO, DPC, and the NCSC in both the UK and Ireland. We employ robust security processes across all of our services and they all continue to run as normal,” Zellis said.

Commenting on the news, a spokesperson for British Airways said: “We have been informed that we are one of the companies impacted by Zellis' cybersecurity incident which occurred via one of their third-party suppliers called MOVEit.

“Zellis provides payroll support services to hundreds of companies in the UK, of which we are one. This incident happened because of a new and previously unknown vulnerability in a widely used MOVEit file transfer tool. We have notified those colleagues whose personal information has been compromised to provide support and advice.”

Retail Systems has reached out to the BBC and Boots for comment.

Share Story: