Small businesses count cost of Royal Mail’s cyber attack

A cyber attack on Royal Mail could hardly have come at a worse time for Alasdair Martin.

The Scot, who with his wife Christine runs Scotland’s Music/Taigh na Teud, a specialist music bookshop on the Isle of Skye, was preparing to ship parcels for Burns Night when he found out that they may not reach their US customers in time. Royal Mail’s international delivery service had been shut down.

“There is a huge backlog of orders that I can’t get in the post,” he said.

Martin is one of many business owners left seething two weeks after Royal Mail first emailed customers warning of a “cyber incident” and encouraging them to “temporarily hold any export mail items”.

Concerns only deepened a day later, when it emerged that its computer system had been targeted by the prolific hacker group LockBit, demanding a ransom payment from the company.

Businesses are still wondering when they can resume sending packages abroad although Royal Mail has restarted the export of some parcels.

Small retailers in particular, which are less likely to have factories and warehouses outside the UK, have borne the brunt of the impact from the cyber attack, which is also preventing ordinary Britons from sending packages abroad. It comes after they have had to contend with disruption from the ongoing strike action by Royal Mail staff.

Zoe Wongsam, owner of jewellery maker Hepburn & Hughes, said her business had already lost “hundreds of pounds” compensating customers for items that did not arrive during the recent postal strikes.

Now she is unable to locate items that she sent before the cyber attack to her company’s silversmith, based in Indonesia. “If that goes missing, that’s effectively our stock for the next six months,” she said.

Hepburn & Hughes has turned to other carriers such as UPS, but Wongsam said these are pricier than Royal Mail and her company cannot absorb the cost in the long term.

“At a time when we should be looking at how to boost exports post-Brexit, the last thing we need is for the basic infrastructure for small firms to fail,” said Craig Beaumont, chief of external affairs at the Federation of Small Businesses.

There are some competitors to Royal Mail who are mopping up

For the UK’s main provider of postal services, the cyber attack “is just another nail in the coffin”, added Clare Bottle, chief executive of the UK Warehousing Association, which represents businesses who store and help deliver goods for retailers across the country. “There are some competitors to Royal Mail who are mopping up.”

The former state-owned business, which traces its history back more than 500 years, has previously warned it faces an existential crisis as clients switch to newer providers like DPD, Yodel and Evri.

The group was already in a battle to retain business customers, after strikes during the peak Christmas period prompted some to turn to other couriers.

The cyber attack has come as Royal Mail shifts its focus from letters towards more profitable parcel deliveries, in an effort to keep up with nimbler rivals. But its modernisation plans have sparked a backlash from workers, who will vote on further strike action this month.

The company has said it is working with France, Germany and the Netherlands to find a workaround to the cyber incident, which hit the system that produces the documentation needed to send items across borders.

Last week, it said it had started delivering “limited volumes” of parcels overseas, adding that Britons could send personal letters that do not require a customs declaration. 

“We would like to sincerely apologise to impacted customers for any disruption,” it said.

More broadly, the cyber attack has intensified concerns about the growing online threat faced by providers of critical national infrastructure. It has also compounded a financial crisis that was already heaping pressure on Royal Mail, raising questions about the future of its “universal service”, which guarantees deliveries at the same cost to anyone within the UK.

Rose Hall, who sells party hats and other items through her online business Postbox Party, said she planned to stick with Royal Mail even after the cyber attack and despite losing “thousands of pounds” during the strikes.

But she questioned whether Royal Mail could continue to price its service attractively if financial pains continue. The company, which told staff last month that it was in a “fight for its life”, warned during the strikes that it was losing £1mn a day. 

As it tried to stem losses, Royal Mail also asked the government in November to reduce its universal delivery service for letters from six days to five, a request that has since been rejected. 

“It would be a shame if [the universal service] had to go . . . Royal Mail enables us to keep our prices as low as we can, so people don’t just go straight to Amazon,” said Hall. “Hopefully by putting our money into Royal Mail we can keep that service alive, because we need them.”