Amanda Jackson
Black October: why cyber security can never stand still
Cyber criminals don’t need to break down the door anymore. Increasingly, they are finding their way in through the technology, suppliers and services that people and businesses already know and trust.
October provided a particularly stark reminder of that.
The month was dubbed “Black October” in parts of the cyber-security community following a flurry of security disclosures involving major businesses, widely used software and technology suppliers. It was not one coordinated attack, but the sheer concentration of incidents highlighted just how quickly the cyber threat continues to evolve.
One particularly eye-catching incident involved ASOS. Customers received an unauthorised notification through the retailer’s own mobile app. ASOS subsequently confirmed that some customer information, including names and contact details, had been accessed.
Elsewhere, a breach involving EY reportedly exposed client information belonging to customers of Goldman Sachs and Man Group, despite their own systems not being compromised.
That is an important distinction.
You can do everything you reasonably can to protect yourself, but we live in an increasingly interconnected world. Your information may be held by retailers, banks, professional advisers and countless other organisations. That means cyber security is no longer simply about protecting one computer or choosing a difficult password.
The threat is constantly evolving
October also demonstrated the extraordinary scale of the challenge.
Microsoft issued 1,411 security fixes during the month, including 70 vulnerabilities rated Critical and three zero-day vulnerabilities. One of those was already being actively exploited. Meanwhile, two critical vulnerabilities discovered in PHP, technology used extensively across the web, prompted guidance for organisations to update affected systems immediately.
Artificial intelligence is adding another dimension. Researchers reported an attacker using autonomous AI agents to target more than 1,200 websites, demonstrating how AI can potentially allow criminals to automate attacks on a scale that would previously have required considerably more time and resources.
For individuals, however, one of the biggest weaknesses remains surprisingly low-tech: us!
Phishing emails, fake text messages, fraudulent phone calls, QR-code scams and increasingly convincing impersonation attempts are all designed to encourage us to act before we have time to think. Equilibrium’s cyber-security materials therefore emphasise that technology alone isn’t enough. Awareness, caution and good habits remain vital.
How do we protect our clients?
At Equilibrium, protecting our clients’ information is a top priority.
We hold Cyber Essentials Plus, an independently assessed cyber security certification, building on the Cyber Essentials accreditation we’ve maintained since 2022.
Client data is securely stored within our Microsoft environment, with access restricted by job role and additional backups providing extra resilience. We also use multi-factor authentication, secure password management and sophisticated spam and phishing filters to help keep our systems protected.
Technology is only part of the solution. Our people receive cyber security training every two to three weeks, alongside regular simulated phishing exercises to keep potential threats front of mind.
We also have robust safeguards around financial transactions. Bank details are not exchanged by email and withdrawal requests are independently verified, helping reduce the risk posed by email interception and impersonation scams.
Pause before you click
No organisation can credibly promise that cyber risk can be eliminated completely. The threat changes too quickly for that.
What we can do is continually strengthen our defences, learn from new threats and help our clients become more difficult targets themselves.
Simple measures still matter: use unique passwords, enable multi-factor authentication, keep devices updated and be suspicious of unexpected messages, links or requests for money or personal information.
Most importantly, if something doesn’t feel right, stop.
That short pause before you click, reply, transfer money or share information could be one of the most effective cyber-security tools you have.
