NFSP Ransomware Attack Turns Supplier Email Pause Into a Security-Control Test

BySTechTimes Editor|Source: Computerweekly

Article summary

The National Federation of Subpostmasters was hit by ransomware after a cPanel-related hosting software bug was exploited. The NFSP was targeted on 30 April, and the Post Office paused some email interactions with the federation while saying branch operations were not affected. The immediate test is whether trusted communications can resume without pushing subpostmasters toward insecure workaround channels.

NFSP Ransomware Attack Turns Supplier Email Pause Into a Security-Control Test

Image source: ComputerWeekly.com

NFSP Email Pause Shows a Supplier-Side Cyber Risk

The National Federation of Subpostmasters (NFSP) has been hit by a ransomware attack after a bug was exploited in software used by its web hosting provider, forcing the Post Office to pause some email interactions with the federation.

The NFSP was targeted on 30 April, days after a vulnerability in cPanel software was discovered and exploited by hackers. cPanel is a web-based hosting control panel used to manage servers and websites.

NFSP CEO Calum Greenhow said the website was hit by ransomware after the cPanel attack.

He said attackers made “demands for release of our files,” the incident had been reported to the Information Commissioner’s Office (ICO), and his IT team had confirmed no data was lost.

Operational Controls Move Beyond the Victim Network

Ransomware is malware that locks or encrypts files, devices or systems until attackers receive payment.

In this case, the immediate operational impact is not described as a Post Office network compromise, but as a disruption to communications with an external supplier.

A Post Office spokesperson said some interactions and integrations with the affected supplier had been temporarily suspended as a precaution.

The spokesperson added that branch operations were not affected and that no compromise of Post Office networks or applications had been identified.

Post Office Chief Information Security Officer Neil Bennett warned subpostmasters on 22 May that inbound and outbound email between the Post Office and the NFSP had been paused.

Emails to @nfsp.org.uk would not be delivered, and emails from @nfsp.org.uk would not reach inboxes during the pause.

The Reader-Risk Control Is Identity and Channel Discipline

Bennett told subpostmasters not to work around the pause using insecure electronic channels such as personal email, text or WhatsApp.

If telephone calls with NFSP stakeholders were required, he advised validating identity before discussing potentially sensitive information, including turning on cameras.

In an update on 2 June, Bennett said the issue remained ongoing and that earlier guidance had not changed.

The practical test is whether the NFSP and the Post Office can restore trusted communications without creating a secondary social-engineering risk through unofficial channels.

#cybersecurity #ransomware #nfsp #post office

Cybersecurity

AI-Built Ransomware Toolkit Turns EDR Evasion Into a Faster Cybercrime Workflow

A ransomware-focused threat actor adopted an AI-built toolkit for Active Directory discovery and endpoint detection and response evasion. Sophos found Cursor and Claude Opus agents assisted development, with close to 80 modules tested against more than 70 techniques. The practical test is whether defenders can shorten validation cycles as AI accelerates the move from offensive research to working malware components.

Cybersecurity

UAE Crypto Discovery Tool Turns Post-Quantum Security Into an Inventory Test

The UAE launched a national Crypto Discovery Tool to help organisations identify and manage cryptographic systems before post-quantum migration. The platform was developed by the UAE Cyber Security Council and Abu Dhabi-based QuantumGate as part of the National Post-Quantum Migration Programme. The practical test is whether public- and private-sector organisations use the tool to build a reliable inventory of cryptographic exposure.

Cybersecurity

CISA Android and Linux Warnings Put Patch Timing Back on the Security Agenda

CISA added exploited Android and Linux vulnerabilities to its Known Exploited Vulnerabilities catalog. The Android flaw affects Android 14 through 16, while the Linux issue centers on older kernel branches and cgroups v1 container environments. The immediate test is whether agencies and infrastructure operators apply vendor updates or mitigations by CISA's June 5 deadline.

Cybersecurity

Cisco Unified CM Flaw Puts WebDialer Exposure Under Patch Pressure

Cisco disclosed fixed-release guidance for a critical Unified Communications Manager flaw that can let attackers gain root privileges when WebDialer is enabled. Cisco PSIRT is aware of public proof-of-concept exploit code for CVE-2026-20230, though it has not found active exploitation or targeting. The immediate test is whether administrators patch Unified CM or disable WebDialer before proof-of-concept code turns into wider exposure.