Racal Acoustics Ltd, INVISIO’s subsidiary in UK, suffered a cyber incident in May of last year which was understood to have been carried out by a criminal ransomware collective based internationally. A press release of this incident was published on our website in June 2024 and can be accessed here: 2024-06-24 Racal Acoustics Ltd (INVISIO’s UK subsidiary) - recent Cyber Incident INVISIO – Corporate.
The response to the attack was robust, with it: (i) engaging market leading third-party cyber security experts to assist its IT team in comprehensively addressing this matter, ensuring that the criminal group had no means of re-accessing its systems and further strengthening IT security; and (ii) engaging with law enforcement and relevant regulatory bodies in respect of the incident. As stated in the June 2024 publication, Racal’s systems were swiftly recovered from backups and operations continued with de minimis disruption.
Racal also conducted a detailed investigation (assisted by external cyber security experts) to determine the scope of the incident and the information that may have been impacted. This was a complex investigation which took a significant amount of time but has since been completed.
What data was involved?
It was determined that files containing the personal data of certain Racal employees (both current and former) / other persons that worked at the company (collectively referred to as “Racal Employees”), were accessed by the cyber criminals. Investigations indicate that the cyber-criminal group was attempting to secure commercially sensitive information in an effort to pressure Racal into making a ransom payment (the criminal group was unsuccessful in these endeavours).
We can also advise that Racal is not aware of any fraud (actual or attempted) arising from the incident. However, out of an abundance of caution, we have elected to post this information on our FAQs page, to supplement other substantive efforts that have been made to inform Racal Employees that: (i) their personal data may have been impacted (such information having generally been provided to Human Resources as part of their employment / work related engagement with Racal); and (ii) to offer them free ID / Credit monitoring support (should they wish to use these services) – further details of which are set out below.
What steps can Racal Employees take?
A list of simple steps that can be taken to guard against fraud and cybercrime are set out on the UK Police’s/Action Fraud’s website, which can be accessed via the following link https://www.actionfraud.police.uk/individual-protection.
We have also secured the services of Experian to provide identity, credit, and dark web monitoring services at no cost to impacted Racal Employees (as defined within the “What data was involved?” section) for 12 months.
Experian is one of the UK’s leading Credit Reference agencies specialising in risk mitigation and response,
Was my information involved? How do I take up the offer of Experian monitoring? What if I have other questions?
Racal considers the misuse of any impacted information to be unlikely, noting that the criminals were seemingly motivated by obtaining a ransom payment from Racal. However, if you are a Racal Employee (as defined within the “What data was involved?” section) and: (i) are concerned that your data may fall within the scope of this incident; (ii) wish to take up our offer of free Experian ID/credit monitoring; or (iii) have any other queries, you should not hesitate to contact Racal at ciqueries@racalacoustics.com.
Please rest assured that our response to this incident has been robust and diligent. However, we appreciate that incidents of this kind naturally give rise to concerns and we are here to answer any questions you might have and assist all Racal Employees in confidently moving past this incident.