Royal Mail hit by ‘cyber incident’ that caused disruption to international post

Britain’s postal and delivery service Royal Mail faced severe disruption to its international export services when they were targeted by a “cyber incident” yesterday evening (11 January 2023).

Royal Mail said that a full investigation has been launched and that customers should hold fire on any items they wish to send internationally while it resolves the matter. Import services remain functional with some delays. 

Royal Mail insures parcels for up to £2,500 in the UK and £250 for overseas.

A Twitter post from Royal Mail said: “We’re experiencing disruption to our international export services and are temporarily unable to despatch items to overseas destinations.

“We strongly advise customers to hold any export items while we work to resolve the issue. Sorry for any disruption this may cause.”

We're experiencing disruption to our international export services and are temporarily unable to despatch items to overseas destinations.

We strongly advise customers to hold any export items while we work to resolve the issue.

Sorry for any disruption this may cause.

— Royal Mail (@RoyalMail) January 11, 2023

Understanding full impact

Royal Mail said it is now working with experts in cyber crime to figure out what happened. 

A National Cyber Security Centre spokesperson said: “We are aware of an incident affecting Royal Mail Group Ltd and are working with the company, alongside the National Crime Agency, to fully understand the impact.”

Royal Mail was privatised in 2015 by the coalition government and the Post Office and Royal Mail were separated. 

Royal Mail which is part of the International Distribution Services has also reported the incident to its regulator, Ofcom and security authorities.

MP Jeremy Corbyn has been campaigning to put Royal Mail back into public hands. 

Political move?

But could this cyber incident be a political move?

Rachael Greaves, chief executive and founder, Australian risk and compliance service, Castlepoint Systems said: “Another storied institution has fallen victim to a cyber-attack, reminding us that nobody is too big to fail in the world of ransomware.”

She explained that on first look this attack seems to be another “cash grab” from a criminal enterprise, although she warned that thinking who the threats might really be aimed at would be useful – especially in terms of mutually beneficial outcomes for the perpetrators.

Greaves continued: “Perhaps this was not just for the money – perhaps it was political - undermining public confidence in British institutions, especially on the back of a week of strikes.

“Perhaps activist - forcing people to think about buying local, reducing the emissions that come from our overreliance on international shipping. Perhaps personal - a disgruntled employee causing havoc.”

Hacks are becoming easier to perpetrate, Greaves noted, and organisations are less likely to pay ransoms.

Greaves added: “There’s no clear evidence identifying the perpetrators either way. We may never know for sure. So, we need to understand all our threat sources, and take steps to protect against each one.

“This means knowing our data, and knowing who is doing what to it, in all our systems, all the time. Impossible just a few years ago, but now simple to implement, and the only effective way to prevent and limit damage to our data.”

Insurance Times has approached Ofcom, for comment, as well as Royal Mail.