CTS

Summary

A cyberattack targeting managed IT services provider CTS caused widespread service outages impacting numerous UK law firms and disrupting legal sector operations, including property transactions. The incident, potentially linked to exploitation of the CitrixBleed vulnerability according to security experts, left firms unable to access case management systems and forced clients to incur unexpected costs due to delayed house sales. The provider engaged third-party forensic experts and notified the UK data protection authority but has not confirmed breach details or provided a restoration timeline, leaving affected organizations to seek alternative solutions for urgent client matters while facing ongoing operational challenges.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late October 2023, CTS, a UK-based managed IT services provider specializing in legal and professional services, experienced a cybersecurity incident causing significant service outages for its clients. The company confirmed the incident publicly on November 1, attributing the disruption to an unspecified cyberattack and engaging a global cyber forensics firm to assist with investigation and restoration efforts. CTS maintained continuous communication with affected clients but declined to disclose the number of impacted organizations or potential data compromises. The UK Information Commissioner’s Office (ICO) received a mandatory breach notification from CTS within the required 72-hour window for personal data incidents, though specific details about data exposure remained unconfirmed. Service restoration efforts progressed without a definitive timeline, with CTS working alongside third-party experts to resolve the outage. The incident’s operational impact became evident when multiple law firms reported losing access to critical systems, including case management platforms, beginning approximately October 25.

The cyberattack caused widespread disruption across the UK legal sector, with approximately 80 law firms experiencing operational paralysis due to inaccessible case files and client management systems. Major clients including Taylor Rose MW, O’Neill Patient Solicitors, and Talbots Law publicly confirmed service interruptions, forcing them to seek alternative solutions for urgent client matters. The incident severely impacted residential property transactions, delaying house sales and purchases nationwide and creating financial strain for clients facing expiring mortgage offers and unexpected accommodation costs. Security researchers suggested exploitation of the CitrixBleed vulnerability (CVE-2023-4966) as a potential attack vector, noting that threat actors including LockBit ransomware operators and nation-state groups were actively leveraging this flaw. These claims referenced an exposed NetScaler appliance linked to Sprout Technologies, a company acquired by CTS in 2020, though CTS neither confirmed nor denied this attribution. Customer testimonials highlighted real-world consequences, including one Taylor Rose client named Lindsay facing potential financial losses due to delayed property transactions jeopardizing her November 30 mortgage expiration. CTS maintained its commitment to restoring services but provided no further technical details about the compromise mechanism or recovery milestones as of early November.

Sources

Sources available to members: 2 sources.