Cyber Incident Victim: James Fisher and Sons
Date:
Nov 2019
Location:
United Kingdom
Summary
Marine services provider James Fisher and Sons experienced a cyber breach involving unauthorized system access by hackers, prompting the company to take affected systems offline as a precaution. The firm engaged cybersecurity experts to restore operations using disaster recovery backups while minimizing business disruption, and it notified relevant UK regulators and law enforcement agencies. The incident caused a significant drop in its share price, though the company did not disclose specifics regarding the attack's nature or potential financial repercussions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 5, 2019, marine services provider James Fisher and Sons Plc (JFS) publicly disclosed a cybersecurity breach involving unauthorized access to its computer systems by hackers. The company immediately took precautionary measures by shutting down all affected systems to contain the intrusion. JFS engaged cybersecurity experts to assist in restoring operations, prioritizing the recovery of systems, applications, and data through its disaster recovery back-up infrastructure. The breach caused immediate financial repercussions, with the company's shares falling as much as 5.7% following the announcement. JFS emphasized ongoing efforts to complete system restoration swiftly while minimizing operational disruptions across its business units. The company did not specify the duration of system downtime or identify which business functions were most impacted by the outage.
JFS formally notified UK regulatory authorities and law enforcement agencies about the breach, though specific agencies were not named in the disclosure. The company declined to provide details regarding the attack methodology, whether data was exfiltrated, or if ransomware demands were involved. No information was released about potential financial losses or insurance claims related to the incident. The disclosure occurred against a backdrop of heightened awareness about cyber threats following the 2017 NotPetya attacks, which had caused global disruptions to maritime and other critical infrastructure sectors. JFS maintained operational silence beyond its initial statement, offering no further public updates about investigation findings, threat actor attribution, or long-term business impacts resulting from the breach.