In 2023 a ransomware attack on KNP Logistics, a 158-year-old Northamptonshire transport company, encrypted its data and locked its internal systems. The company was unable to recover and went into administration, with the loss of around 700 jobs. The case shows how a single compromised account can become a threat to an organisation's survival, and how far the outcome depends on whether the organisation can restore its systems and data.
What is on the public record
According to BBC reporting in July 2025, KNP operated around 500 lorries, mostly under the Knights of Old brand. Attackers are thought to have gained entry by guessing an employee's password. They then encrypted the company's data and locked its internal systems. Trade press reports attribute the attack to the Akira ransomware group.
The company said its IT met industry standards and that it held cyber insurance. Trade press coverage of the BBC Panorama programme reported that the insurer's crisis team found the company's servers, backups and disaster recovery systems had also been affected. The attackers did not name a price, and a ransomware negotiation firm estimated the demand could have been as much as £5 million, which the company could not afford. Its data was lost and it called in administrators.
Paul Abbott, a director of KNP, has argued for more understanding of cyber risk at board level and has proposed a form of "cyber MOT" that would require companies to show their IT protections are up to date.
Why access security belongs on the board agenda
An account protected only by a password can be entered by anyone who obtains that password. Where it can be guessed or has been reused elsewhere, an attacker can log in as a legitimate user without needing to trick anyone or exploit a technical flaw. Multi-factor authentication, which asks for a second proof of identity such as a code from a phone or a physical key, makes a stolen or guessed password far less useful on its own.
The NCSC recommends multi-factor authentication for important accounts and advises organisations to help staff choose strong passwords, for example by allowing password managers. Cyber Essentials, the government-backed baseline certification, requires multi-factor authentication for cloud services where it is available. Accounts with administrative rights and those that allow remote access to the organisation's network carry the greatest risk if compromised, and protecting them is a decision about business risk that the board can ask management to evidence.
How recovery shapes the outcome
Preventive controls reduce the likelihood of a successful attack. The ability to restore systems and data has a large bearing on how much an attack costs once it has succeeded. Where an attacker can reach and destroy an organisation's backups as well as its live systems, the organisation may be left with a choice between paying a criminal or rebuilding without its data.
The NCSC advises organisations to keep backups that are separated from the main network, so that an attacker with access to live systems cannot alter or delete them, and to test that data can be restored from them. Backups of financial, customer and operational records, and of the information needed to rebuild core systems, warrant particular attention because the business may be unable to trade without them.
Cyber insurance can fund specialist response, legal advice and some financial losses. It cannot restore data that has been destroyed. A board relying on insurance as part of its resilience can check what the policy covers, what conditions it attaches to controls such as backups and multi-factor authentication, and how the insurer's response team would work alongside the organisation's own.
Testing whether recovery works
Until recovery has been tested, the organisation has limited evidence of how long it would take. Exercises that restore critical systems from backup show how long recovery takes, which dependencies are missing and whether the people involved know their roles. Comparing the measured restore time with the length of disruption each part of the business can tolerate shows the board where the gaps lie.
Exercises can also test decisions. These include who declares an incident, who speaks to customers, staff and regulators, and who would decide whether to engage with an attacker's demand.
What leadership should require
The board should expect management to confirm that multi-factor authentication protects remote access, email, cloud services and administrative accounts, and to report any exceptions with a plan and a date to close them. Management should be able to show that backups of critical data are separated from the main network and that restoration has been tested within a defined period, with the results reported to the board.
The board should also see a recovery plan that names the systems and records the business needs first, the time it would take to restore them, and the people responsible for each step. For a smaller organisation, Cyber Essentials provides a recognised baseline against which to measure these controls.
Questions for the board
- Which accounts give access to our most critical systems and data, and are they all protected by multi-factor authentication?
- Could an attacker who gained administrative access to our network also reach and delete our backups?
- When did we last restore a critical system from backup in a test, and how long did it take?
- How long could we keep trading without our financial and operational records?
- What does our cyber insurance cover, and what conditions does it place on our controls?
- Who would lead our response in the first hours of an attack, and have they rehearsed it?
- Do we hold Cyber Essentials, or an equivalent baseline, and what did the last assessment find?
Epitechnic's Cyber Risk and Security Assurance practice reviews identity, access control, privileged access and recovery arrangements, and gives an independent view of where they fall short of the organisation's business priorities.
References
- BBC News, "Weak password allowed hackers to sink a 158-year-old company", 21 July 2025.
- BBC One, Panorama, "Fighting Cyber Criminals", 21 July 2025.
- Motor Transport, "Employee's weak password opened door to Knights of Old's cyber attackers, BBC documentary reveals", July 2025.
- National Cyber Security Centre, "Multi-factor authentication for your corporate online services".
- National Cyber Security Centre, "Offline backups in an online world" and "Principles for ransomware-resistant cloud backups".
- National Cyber Security Centre, "Cyber Essentials: Requirements for IT infrastructure".