Calls for audit reforms intensify after hackers attack Harrods and other top UK retailers

Cyberattacks on major UK retailers, including Marks & Spencer, Harrods and Co-op, left the companies scrambling to reassure customers and staff about stolen data, pushing issues of cybersecurity and cyber resilience back into the national debate. Now the question is whether compliance managers should expect more technology regulations, or will legislators focus on corporate governance, internal controls and resilience. 

Governments across the world are introducing digital and AI regulations to protect consumers and society from intentional and unintentional digital harm. But the ransomware attacks that disabled key players in the U.K. retail sector from April 25 aren’t a new phenomenon enabled by unregulated technology.

Rather, these attacks highlighted failures in internal controls. This was made clear in messages immediately after the attacks began in April from the National Cyber Security Centre (NCSC), warning retailers to guard against scammers impersonating IT support staff to trick employees into revealing their passwords.