Manchester United working with infosec experts to ‘minimize ongoing IT disruption’ caused by ‘cyber attack’

Manchester United is working with infosec pros to “minimize the ongoing IT disruption” that it says was caused by an assault on its tech systems.

The New York Stock Exchange listed football business confirmed the incident last night but didn’t clarify the technical nature of it, and refused to answer questions posed by The Register.

“Manchester United Plc can confirm that the club has experienced a cyber attack on its systems. The club has taken swift actions to contain the attack and is currently working with expert advisers to investigate the incident and minimise the ongoing IT disruption”.

“Although this is a sophisticated operation by organized cyber criminals, the club has extensive protocols and procedures in place for such an event and had rehearsed for this risk. Our cyber defenses identified the attack and shut down affected systems to contain the damage and protect data,” the club statement continued.

The club media channels, including the website and mobile app are “unaffected and we are not currently aware of any breach of personal data associated with our fans or customers”, Manchester United stated.

“All critical systems required for matches to take place at Old Trafford remain secure and operational,” it added. As such, today’s game against West Bromwich Albion took place as scheduled.

A spokesman for the club said there was nothing further to add at this stage and as such would not answer questions we asked about the variant of threat the club was forced to defend itself against.

In its Annual Report for fiscal year 2000, Man U said that as a high profile business its IT systems are at risk of attack.

“Though we seek to protect ourselves by putting processes in place that are designed to prevent such attack and regularly monitor alerts and updates from leading cyber security vendors and trusted authorities, our IT systems and other third-party systems utilized in our operations may still be vulnerable to external or internal security breaches, acts of vandalism, computer viruses or other forms of cyber-attack.”

Stuart Reed, UK director of Orange Cyberdefense, said it is not surprising that crims are targeting organisations operating in the lucrative Premier League.

“While details of this incident are unclear, since the outbreak of COVID-19 we have seen numerous examples of hackers capitalising on the crisis by using social engineering attacks to trick their way into corporate systems. Technical countermeasures against phishing attempts and detecting malicious activities are much more robust than they have been in the past.

“The human, on the other hand, is more complex and hard to predict in certain scenarios while easy to manipulate in others. Security awareness educates employees about manipulative techniques that might be used against them and also highlights the benefits of adapting their information security behaviour.”

According to the National Cyber Security Centre, 70 per cent of sports organisations it surveyed for a July study reported being the victim of at least one security attack each year, mostly from criminals with a financial motive that typically exploit the “poor implementation of technical controls and normal human traits such as trust and ineffective password policies”.

Manchester United have informed the Information Commissioner’s Office. ®

READ MORE HERE