Hackers could bring Britain’s essential services to a standstill, security chief warns after global website shutdowns

Government, council and healthcare websites were taken offline after critical software vulnerabilities sparked an international security alert. In a new Business Matters interview with Juliette Foster, Information Security Forum chief executive Steve Durbin warns that attackers are increasingly targeting the systems on which everyday life depends

Hackers could bring Britain’s electricity, water, healthcare and transport systems to a standstill, a leading cyber security expert has warned, as organisations across Europe scramble to protect themselves against critical software vulnerabilities.

Steve Durbin, chief executive of the Information Security Forum (ISF), said criminals and hostile states were increasingly exploiting ageing technology, stolen passwords and sophisticated deception to gain access to organisations providing essential services.

The warning follows yesterday’s shutdown of government and other public-sector websites after two serious security flaws were discovered in PHP, a programming language used extensively across the internet.

Several organisations took their services offline as a precaution amid reports that hackers were already attempting to exploit the vulnerabilities, with further attacks feared as criminals look for ways into unprotected systems.

Durbin said hackers who gain access to company systems can then blackmail their victims or deploy ransomware – malicious software that locks users out of their files or computer systems and demands payment to restore access, often accompanied by threats to publish stolen information.

Speaking to Juliette Foster for Business Matters, he identified three reasons why critical infrastructure was particularly vulnerable – outdated systems connected to the internet, the pressure to restore essential services quickly, and hostile governments using criminal groups to carry out attacks on their behalf.

“Nobody wants to be without electricity. Nobody wants to be without water. Nobody wants to be just about to be wheeled into an operating theatre to find that all the systems go down,” he added.

The National Cyber Security Centre (NCSC) has handles more than 200 incidents affecting Britain’s critical national infrastructure each year, with around three-quarters believed to be linked to hostile state actors.

Durbin said organisations were spending too much on preventing attacks and too little on preparing for the consequences when their defences failed.

He cited a UK government worst-case assessment suggesting that recovery from a serious attack on the water sector could take several months.

A growing problem, he explained, was that criminals were increasingly entering company networks through legitimate user accounts rather than breaking through security barriers.

“Attackers these days don’t tend to break in,” he said. “They log in.”

Hackers can steal passwords, impersonate employees or enter through suppliers, then spend time studying an organisation’s systems before launching an attack. Some deliberately target backup systems to prevent the business recovering.

Durbin described a manufacturer whose factories were brought to a halt after criminals disabled its corporate IT network, despite leaving the factories’ own systems untouched.

Artificial intelligence was making such attacks easier to carry out, he warned, with criminals able to purchase ready-made tools for producing fraudulent emails, cloning voices and distributing malicious software.

He said: “They’re using AI just like we are. And it’s the as a service piece that really worries me the most because that removes the need for the attacker to be hugely sophisticated.”

Another threat comes from criminals and hostile operatives gaining legitimate employment inside organisations using false identities.

Durbin highlighted North Korean IT workers who apply for remote positions using fabricated credentials and manipulated video appearances, potentially securing access to company networks once hired.

“They’re now a trusted insider because you’ve hired them into your organisation,” he added.

He warned that European businesses employing remote workers were also vulnerable to the practice.

Durbin called for closer cooperation between government and privately owned infrastructure providers, arguing that public-sector procurement and regulation often struggled to keep pace with rapidly developing cyber threats.

He also urged company directors to understand the risks associated with new technologies before committing substantial sums to AI projects, particularly during difficult economic conditions.

Watch the full interview with Steve Durbin, chief executive of the Information Security Forum, on Business Matters at 9.30am on Saturday 24 October, on Bloomberg TV, available on Sky 502, Sky Glass 505, Virgin 609 and Freesat 208. The interview will also be streamed live simultaneously on The European’s YouTube channel.

VIEW MORE: Burnham told to tackle Britain’s cyber weak spots on day one. Security chief warns digital exclusion is leaving the country exposed as new Prime Minister enters Downing Street.

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main image: The European}