CPI

Summary

A London-based literary agency suffered a ransomware attack that encrypted company data files and caused a significant IT outage. The Rhysida ransomware group claimed responsibility and threatened to publish stolen data if a ransom was not paid, prompting the organisation to engage IT and cyber security specialists along with the Metropolitan Police Service cybercrime unit to investigate. The agency notified its clients that their personal data may have been copied and warned them to be vigilant against potential fraudulent communications. The attack has disrupted operations, with the team focused on containment, recovery, and assessing the scope of the data compromise while implementing additional protective security measures.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In the early hours of Friday, 7th February 2025, the UK-based book printer CPI suffered a cyber attack that disabled its IT systems and affected the UK part of its business. Following initial forensic analysis, the company determined it had encountered a cyber attack despite having significant protection already in place across its entire network. As soon as the attack was identified, CPI engaged specialist external technical support, who, alongside internal teams, worked to recover the systems as quickly as possible. Colleagues across the whole business developed workarounds and began reimplementing IT systems, making substantial progress in the immediate aftermath. CPI continued dialogue with customers and other stakeholders to keep them informed of the status. The company stated that it expected to resume full services gradually over the coming days. CPI Books is the UK’s leading book printing group, operating across nine UK factories and producing around 160 million books every year, along with journals and loose-leaf products.

The same week, a separate ransomware attack hit The Agency, a London-based literary agency. The Rhysida ransomware group, previously known for targeting the British Library in autumn 2023, claimed responsibility for the breach and threatened to publish stolen data if a ransom was not paid. The attack caused a significant IT outage as the malware encrypted company data files and prevented access. Jessica Hare, who heads up the books department at The Agency, circulated an email informing clients that their personal data may have been copied and, if the criminals carried through their threat, may be leaked. IT specialists and an additional cyber security company worked to identify which items of data had been copied, but the Rhysida methodology involves defence evasion and anti-forensics, including a deliberate "clean-up" phase, making it difficult to trace attacker activity. At the time of reporting, there was no evidence that any data had been made public, although clients were advised to be vigilant about their accounts and emails. The Agency was also in contact with the Metropolitan Police Service cybercrime unit as part of the investigation.

The impact of the CPI attack rippled through its client base, with smaller publishers reporting serious financial consequences. Firefly Press, a Welsh independent publisher, was majorly affected, with publisher Penny Thomas noting that profits had been effectively wiped out on some print runs. One book at the printers, due out in March, had to be digitally printed elsewhere at short notice, and two to three print runs in total had to be re-routed to alternative providers. Thomas stated that she had been forced to do this with two to three print runs, which would effectively wipe out some of the profits on those runs. Firefly Press was completely out of stock with one title, and the uncertainty over when CPI would resume full services made it difficult to maintain normal inventory levels. Thomas noted that alternative printers were either unable to fit the work in or were not as competitive on price. She expressed sympathy for CPI, acknowledging that the company had communicated well and was trying its best with workarounds despite the disruption.

The Agency's response included targeted protective measures to ensure the security of its systems, with continued close monitoring prioritised. The company stated that it was continuing to investigate the attack with the assistance of IT and cyber security specialists and the Metropolitan Police Service cybercrime unit. Clients were urged to be wary of new details apparently sent out by The Agency and to contact the company immediately if they were in doubt about any communications. The Agency declined to add any further comment beyond the circulated email, citing that the team was busy dealing with the fall-out from the incident. It was noted in the communication that several companies had been attacked in the same week, highlighting the broader pattern of ransomware activity affecting UK organisations. It remains unknown whether the Rhysida ransomware group was also responsible for the CPI attack. The British Library reportedly spent around £6 million rebuilding its digital services after its own Rhysida attack in autumn 2023, providing context for the potential scale of recovery facing affected organisations.

Sources

Sources available to members: 1 source.