Royal Mail boss to face MPs’ questions over Russian ransomware attack

Royal Mail’s chief executive is to face questions from MPs over the Russia-linked ransomware attack that caused international deliveries to grind to a halt this week.

Simon Thompson, chief executive of Royal Mail, will be asked about Tuesday’s cyber attack when he appears before the Commons business select committee.

It is understood Committee members want to discuss Royal Mail’s response to the cyberattack at the evidence session on Tuesday Jan 17.

A Royal Mail spokesman said: “Royal Mail has been subject to a cyber incident that is affecting our international export service. We are focused on restoring this service as soon as we are able.”

MPs are scheduled to question Mr Thompson over his company’s handling of strikes from the CWU trade union, as well as CWU general secretary Dave Ward and Post Office boss Nick Read.

Last week Royal Mail was forced to suspend all outbound international post after machines used for printing customs dockets were disabled by the Russia-linked Lockbit cyber crime gang.

Lockbit’s attackers used ransomware, malicious software that scrambles vital computer files before the gang demands payment to unlock them again.

The software also took over printers at Royal Mail’s international sorting offices and caused ransom notes to “spout” from them, according to reports.

Cyber security industry sources cautioned that while Lockbit is known to be Russian in origin, it is not known whether a stolen copy of the gang’s signature ransomware had been deployed by rival hackers.

Peter McKenzie, director of incident response at cyber security company Sophos, said: “In this attack it appears that the information on the ransom note provided to the victim by the attacker directs them to the genuine Lockbit site and communication method.

“This would indicate it was done by Lockbit, however at the moment it appears that Lockbit has denied it was them.”

Royal Mail is classed by the Government as critical national infrastructure (CNI). The criminals behind Lockbit have previously said they avoid attacking CNI, in what experts say is an attempt to avoid attention from Western cyber-security agencies.

The National Cyber Security Centre, a division of GCHQ, is helping Royal Mail fix the damage caused by the hackers.

Lockbit has threatened to publish data stolen from Royal Mail, though at the time of writing it is unclear what information the criminals have obtained.