London & Zurich

London & Zurich operates as a direct debit provider based in the United Kingdom. Its core service involves processing direct debit payments on behalf of business customers. The organisation facilitates the collection of funds from end customers through the direct debit system, acting as a critical intermediary in the payment processing chain for its client businesses. This service is fundamental to the cash flow operations of the companies relying on it. The incident description confirms its role in enabling businesses to collect payments via direct debit mandates.

The ransomware attack in November 2023 severely disrupted London & Zurich's operations, preventing multiple customer businesses from processing their direct debit collections. This led to significant six-figure payment backlogs and caused severe cash flow issues for affected clients. At least one business required emergency loans due to the outage, while others faced uncertainties meeting payroll obligations. Communication during the incident was inconsistent and unclear, with conflicting timelines provided for service restoration, exacerbating the difficulties faced by customers. The company undertook a substantial recovery effort, rebuilding its compromised environment on new infrastructure. Service restoration, including API functionality and customer portal access, occurred gradually over several weeks following the attack. Payment schedules dating back to the initial breach date needed to be resubmitted by clients, with partial recoveries processed days after the intended collection dates. While London & Zurich confirmed the attack was contained and involved third-party forensic investigators, it declined to disclose specifics regarding potential data compromise, the identity of the attackers, or the initial breach vector. The prolonged disruption highlighted the systemic vulnerabilities inherent in payment processing intermediaries and their critical role in the financial operations of their business clients, particularly during crucial financial periods. The company's infrastructure rebuild was necessary to restore core payment processing capabilities.