One password is believed to have been all it took for a ransomware gang to destroy a 158-year-old company and put 700 people out of work.
KNP – a Northamptonshire transport company – is just one of tens of thousands of UK businesses that have been hit by such attacks.
Big names such as M&S, Co-op and Harrods have all been attacked in recent months. The chief executive of Co-op confirmed last week that all 6.5 million of its members had had their data stolen.
In KNP’s case, it’s thought the hackers managed to gain entry to the computer system by guessing an employee’s password, after which they encrypted the company’s data and locked its internal systems.
KNP director Paul Abbott says he hasn’t told the employee that their compromised password most likely led to the destruction of the company.
“Would you want to know if it was you?” he asks.
“We need organisations to take steps to secure their systems, to secure their businesses,” says Richard Horne CEO of the National Cyber Security Centre (NCSC) – where Panorama has been given exclusive access to the team battling international ransomware gangs.
One small mistake
In 2023, KNP was running 500 lorries – most under the brand name Knights of Old.
The company said its IT complied with industry standards and it had taken out insurance against cyber-attack.
But a gang of hackers, known as Akira, got into the system leaving staff unable to access any of the data needed to run the business. The only way to get the data back, said the hackers, was to pay.
“If you’re reading this it means the internal infrastructure of your company is fully or partially dead…Let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue,” read the ransom note.
The hackers didn’t name a price, but a specialist ransomware negotiation firm estimated the sum could be as much as £5m. KNP didn’t have that kind of money. In the end all the data was lost, and the company went under.
The National Cyber Security Centre (NCSC) says its goal is “to make the UK the safest place to live and work online”. It says it deals with a major attack every day.
The NCSC is part of GCHQ, one of the UK’s three main security services alongside MI5 and MI6.
The hackers are not doing anything new, says “Sam” (not his real name), who runs a NCSC team dealing with day-to-day attacks. They are just looking for a weak link, he tells Panorama.
“They’re just constantly finding organisations on a bad day and then taking advantage of them.”
Using intelligence sources, NCSC operatives try to spot attacks and eject hackers from computer systems before they can deploy ransom software.
How we can avoid cyber attack
Expert Analysis
Cybersecurity professionals have identified several critical security lapses:
- Inadequate Password Policy – Use of easily guessable credentials with no enforced complexity or rotation.
- Lack of Multi-Factor Authentication (MFA) – High-privilege accounts had no additional security layers.
- Outdated Software Infrastructure – Legacy systems contained known vulnerabilities.
- Absence of Security Training – Employees were unprepared to identify and report phishing or suspicious activity.
- No Incident Detection System – The breach went unnoticed until financial losses were already underway.
“This event highlights how a single point of failure — in this case, a weak password — can compromise the integrity of an entire enterprise,” said Rajiv Mehra, Cybercrime Analyst at Interpol.
Preventative Measures: Best Practices
Recommended Actions
- Enforce Strong Password Policies
Minimum 12 characters with complexity requirements and periodic expiration. - Implement Multi-Factor Authentication
Required for all admin and financial access points. - Conduct Routine Security Audits
Evaluate system vulnerabilities and access controls regularly. - Employee Cybersecurity Training
Conduct monthly workshops on threat awareness and response protocols. - Adopt Endpoint Detection & Response (EDR)
Real-time monitoring for unauthorized access and lateral movement. - Backup Critical Data
Maintain encrypted, isolated backups to ensure operational recovery.