Cyber attack on tech vendor disrupted Serco's prisoner transport service

The Microlise Group, a Nottingham-based transportation technology solutions provider, experienced a data security incident that affected tracking systems at several companies, including Serco.

 

In a data security incident notification filed with the London Stock Exchange, Microlise said that it suffered a cyber attack that affected “large portion of the Company’s services” that “resulted in disruption to services which are currently inactive.”

 

The company has launched an investigation and has appointed external cyber security experts to determine the nature and scope of the incident. Microlise has also notified relevant regulators and law enforcement agencies, including the Information Commissioner’s Office.

 

Several companies who use Microlise’s service were impacted by the cyber attack, including Serco, a company that provides prisoner escort services for the Ministry of Justice. 

 

According to reports, location tracking, panic alarms, navigation services and notifications related to estimated arrivals are currently unavailable for the fleet. Drivers were forced to use paper maps to navigate and check in with prison bases every 30 minutes.

 

In a statement shared with SecurityWeek, a Serco spokesman said, “We are aware that one of our subcontractors has been impacted by a cyber incident.  We have put in place mitigation plans and we have continued to provide prisoner escorting services uninterrupted for the Ministry of Justice.”

 

In a recent update, Microlise said “that it is making substantial progress in containing and clearing the threat from its network.”

 

“The Company has been bringing services back online and currently expects this to continue over the coming days with the services essentially back to normal by the end of next week,” reads the update.

 

While the investigation is still ongoing, Microlise believes that no customer systems data was compromised during the incident.

 

“The investigations to date have identified that some limited employee data has been impacted by the incident. Those individuals that may have been impacted will be notified in line with the Company’s regulatory obligations,” Microlise added.