Royal Mail's "cyber incident"

[Admiral Puff]

I've got a couple of orders in transit from the UK. Neither having arrived within the usual time scale (10-14 days), I followed up with the tracking numbers. It seems that due to a "cyber incident" Royal Mail is not accepting, or at least not handling, overseas parcels at the moment. However, the RM web site gives precious little more information, and in particular no detail of what said "incident" involves or how long things are likely to be in limbo. Can anyone enlighten me, please? (As an aside, I note that even though my parcels aren't getting to me, my credit card has nevertheless been debited!)

[Francis Macnaughton]

I was wondering if the cyber attack also had any effect on parcels inbound from abroad as well.  Is anyone in a position to say if there has been any disruption to deliveries here in UK?  

[Whofan]

This may be of some help;

 

https://www.royalmail.com/international-incident-bulletin

[Stephen]

1 hour ago, Francis Macnaughton said:

I was wondering if the cyber attack also had any effect on parcels inbound from abroad as well.  Is anyone in a position to say if there has been any disruption to deliveries here in UK?  

It doesn't, I received an order from hobbyeasy in Hong Kong shipped six days ago. It's outgoing items that are affected.

[Skodadriver]

This may be helpful. It includes links to several other reports of the incident.

 

It's a worrying thought that if Russian "criminals" can disrupt Royal Mail so effectively can they do the same to, say, the National Grid or some other critical infrastructure?

 

Dave G

[Admiral Puff]

1 hour ago, Whofan said:

This may be of some help;

 

https://www.royalmail.com/international-incident-bulletin

Sorry, it doesn't - it doesn't tell me what happened, and I'm interested in parcels to Australia rather than Northern Ireland.

50 minutes ago, Skodadriver said:

This may be helpful. It includes links to several other reports of the incident.

 

It's a worrying thought that if Russian "criminals" can disrupt Royal Mail so effectively can they do the same to, say, the National Grid or some other critical infrastructure?

 

Dave G

Thanks for that, Dave! At least now I know what's behind it all. The child in the Kremlin has much for which to answer ... Good to know, too, that RM has started to clear the backlog - hopefully my stuff will get here eventually. It would have been even more helpful if they'd been more open about the problem in the first place, though.

[Whofan]

16 hours ago, Admiral Puff said:

Sorry, it doesn't - it doesn't tell me what happened, and I'm interested in parcels to Australia rather than Northern Ireland.

 

No problem, I just had a quick loom at it so didn't see the lack of detail.

 

16 hours ago, Admiral Puff said:

It would have been even more helpful if they'd been more open about the problem in the first place, though.

 

I'm with you definitely on this one, I think it's important to recognise that this is an example of corporate refusal to say anything has gone wrong, probably caused by fear of litigation.

 

It's obvious that Royal Mail and computers are not the most harmonious of matches - you only have to look at the problems with its Horizon software, and the blank failure to admit anything might be wrong at their end, to see why they would be as close mouthed as possible over this attack, which would probably reveal that the post office is running on windows 95, or some similar old software.

 

 

 

[Admiral Puff]

Windows 95? Are they that up-to-date?

 

And I've now heard from my vendor (a certain institution on the right-hand side of your island) to say that they've now started to post overseas parcels again. It seems that RM asked everyone not to put overseas parcels into the system until it had sorted its "problems" out - so even though I had tracking numbers, my stuff was probably sitting in a warehouse somewhere and hadn't been anywhere near RM. Oh well ...

[3DStewart]

On 1/25/2023 at 11:05 PM, Skodadriver said:

It's a worrying thought that if Russian "criminals" can disrupt Royal Mail so effectively can they do the same to, say, the National Grid or some other critical infrastructure?

 

If the grid went down it would be horrifying, Britmodeller would switch off!

[Mike]

27 minutes ago, 3DStewart said:

Britmodeller would switch off!

Not actually true though.  We'd lose our access to it because the internet in the UK would die of electron hunger. The rest of the world would still be able to view the site, or anyone in the UK with their own portal onto the worldwide part of the web and independent power supply.  My machine and NAS would close down in an ordered manner as the UPS battery drained, but with nothing to look at online there's no need for it

[JohnT]

6 minutes ago, Mike said:

Not actually true though.  We'd lose our access to it because the internet in the UK would die of electron hunger. The rest of the world would still be able to view the site, or anyone in the UK with their own portal onto the worldwide part of the web and independent power supply.  My machine and NAS would close down in an ordered manner as the UPS battery drained, but with nothing to look at online there's no need for it

I heard the back up was you and @Julien on a tandem going like the clappers with a belt linked to a dynamo 

[Admiral Puff]

Oh GAWD - it's too soon since breakfast for an image like that!

[Julien]

1 hour ago, Admiral Puff said:

Oh GAWD - it's too soon since breakfast for an image like that!

too right

[alt-92]

On 1/26/2023 at 12:05 AM, Skodadriver said:

can they do the same to, say, the National Grid or some other critical infrastructure?

Some targets are steered well clear of in order to avoid major effort from GCHQ and international LE to go after the culprits. 

Targeting a nation's critical infrastructure like power grids on a large scale tends to be viewed as an act of war. 
 

[e8n2]

What perturbs me the most about this whole situation is that the Royal Mail announced the problem on the 11th.  So every vendor in the UK knew about it at that time.  I placed an order with Hannants on the 13th.  When my order still hadn't shipped by the 20th I sent them an e-mail asking them what was going on.  On the 23rd I got a response telling me about the cyber attack.  I did a check on line to verify it.  Why in the HE__ they didn't have a notice in big letters on the home page as soon as this happened is beyond me.  Two days after I complained about it they finally stated what the problem was.  It shouldn't have taken customers asking questions about it for them to tell people what was going on.  Today they say things are moving again and they hope to get the backlog mostly cleared up in 48 hours.  Time will tell.  As someone else previously mentioned, I also didn't care for my credit card hard posting the transaction without the items already being in transit.  This is not the way to keep customers happy and coming back.  Back in 1982 Tylenol was the victim of somebody putting poison into bottles of Tylenol.  They did not try to hide it.  They came right out and told everyone what was going on and steps being taken to prevent it happening again.  They quickly regained their normal market share and the good will of millions of people.  Hannants and any other vendors sending packages outside of the UK would be well advised to follow Tylenol's example.  Tell you customers directly what is going on and when the situation may be corrected.  Before an overseas customer places an order, tell them of the situation BEFORE they hit the place order button.  There is nothing that Hannants and the others can do to prevent the situation happening, but they can be more forth coming with their customers as to what is going on.  Failing to do so will only hurt them in the long run.

Later,

Dave

 

[Julien]

16 hours ago, e8n2 said:

What perturbs me the most about this whole situation is that the Royal Mail announced the problem on the 11th.  So every vendor in the UK knew about it at that time.  I placed an order with Hannants on the 13th.  When my order still hadn't shipped by the 20th I sent them an e-mail asking them what was going on.  On the 23rd I got a response telling me about the cyber attack.  I did a check on line to verify it.  Why in the HE__ they didn't have a notice in big letters on the home page as soon as this happened is beyond me.  Two days after I complained about it they finally stated what the problem was.  It shouldn't have taken customers asking questions about it for them to tell people what was going on.  Today they say things are moving again and they hope to get the backlog mostly cleared up in 48 hours.  Time will tell.  As someone else previously mentioned, I also didn't care for my credit card hard posting the transaction without the items already being in transit.  This is not the way to keep customers happy and coming back.  Back in 1982 Tylenol was the victim of somebody putting poison into bottles of Tylenol.  They did not try to hide it.  They came right out and told everyone what was going on and steps being taken to prevent it happening again.  They quickly regained their normal market share and the good will of millions of people.  Hannants and any other vendors sending packages outside of the UK would be well advised to follow Tylenol's example.  Tell you customers directly what is going on and when the situation may be corrected.  Before an overseas customer places an order, tell them of the situation BEFORE they hit the place order button.  There is nothing that Hannants and the others can do to prevent the situation happening, but they can be more forth coming with their customers as to what is going on.  Failing to do so will only hurt them in the long run.

Later,

Dave

 

From what I gather at first it was thought account customers were still working and the RM was accepting orders from them but not accepting the like of me walking into a PO to send a parcel.

 

Given RM's statement they are processing account customers over all others. 

 

I really dont think Hannants or thousands of other businesses have done anything wrong here, it would have been a major thing to try and contact everyone, they may have been able to switch off international ordering depending on how their computer systems are set up.

 

Also TBH RM were not that straight forward at the start earlier. 

 

I dont think you can expect the same response for not being able to ship a product as to something that is going to kill people. 

[Admiral Puff]

I lay the blame squarely at RM's feet. If they'd been on the ball, they would have flagged the problem as soon as they became aware of it, and done so in a very public manner so that everyone knew what was going on. I don't blame my vendor, or others like it - they posted stuff in good faith; their chosen carrier let them down for no apparent reason other than to protect a reputation. That worked a treat, didn't it ...

[e8n2]

6 hours ago, Julien said:

From what I gather at first it was thought account customers were still working and the RM was accepting orders from them but not accepting the like of me walking into a PO to send a parcel.

 

Given RM's statement they are processing account customers over all others. 

 

I really dont think Hannants or thousands of other businesses have done anything wrong here, it would have been a major thing to try and contact everyone, they may have been able to switch off international ordering depending on how their computer systems are set up.

 

Also TBH RM were not that straight forward at the start earlier. 

 

I dont think you can expect the same response for not being able to ship a product as to something that is going to kill people. 

Sorry Julien, I disagree.  As soon as they became aware of the problem, they had a duty to make note of it prominently on the home page.  It would not have cost them any money and people would have appreciated knowing about it first hand.  Waiting nearly two weeks and then only after customers started to complain is not a good way to do things.  As an example, right after Brexit took effect, Sprue Brothers had a statement up on their homepage stating that for the time being they  were unable to ship to the UK until certain issues got straightened out.  That statement is no longer there so hopefully they are now able to fulfill orders to the UK.  Didn't cost them a penny to do it.

Later,

Dave

[e8n2]

4 hours ago, Admiral Puff said:

I lay the blame squarely at RM's feet. If they'd been on the ball, they would have flagged the problem as soon as they became aware of it, and done so in a very public manner so that everyone knew what was going on. I don't blame my vendor, or others like it - they posted stuff in good faith; their chosen carrier let them down for no apparent reason other than to protect a reputation. That worked a treat, didn't it ...

According to the Beeb, RM was aware of the problem on the 9th, tried to take care of it, and realized it would take longer than a day, and made a general announcement about the situation on the 11th.   It is not all the RM's fault that Hannants didn't make an announcement of the situation until the 25th at the earliest.

Later,

Dave

[IanHx]

12 minutes ago, e8n2 said:

Sorry Julien, I disagree.  As soon as they became aware of the problem, they had a duty to make note of it prominently on the home page.  It would not have cost them any money and people would have appreciated knowing about it first hand.  Waiting nearly two weeks and then only after customers started to complain is not a good way to do things.  As an example, right after Brexit took effect, Sprue Brothers had a statement up on their homepage stating that for the time being they  were unable to ship to the UK until certain issues got straightened out.  That statement is no longer there so hopefully they are now able to fulfill orders to the UK.  Didn't cost them a penny to do it.

Later,

Dave

 

Personally I'd cut them some slack - I suspect the immediate response to a ransomeware attack is "quick,  switch everything off and then we'll try to flush it from our network one machine at a time"   ,  not  "we'd better update our website then deal with it".

 

Having said that, there are other communication options they could have used to let customers know what was going on. But British corporations are very reticent about going public about being hacked, both from fear of loss of future trade, and not wanting to give up the slim possibility of getting the decryption key if they pay up.

Edited January 29, 2023 by IanHx

[e8n2]

5 minutes ago, IanHx said:

 

Personally I'd cut them some slack - I suspect the immediate response to a ransomeware attack is "quick,  switch everything off and then we'll try to flush it from our network one machine at a time"   ,  not  "we'd better update our website then deal with it".

 

Having said that, there are other communication options they could have used to let customers know what was going on. But British corporations are very reticent about going public about being hacked, both from fear of loss of future trade, and not wanting to give up the slim possibility of getting the decryption key if they pay up.

Look at my original post about how Tylenol handled a bad situation.  Not being upfront about situations will end up costing you more in the long run than putting it right out there to begin with.  Tylenol is still a multi-billion dollar company.  The RM are the one's who got the cyber attack.  They announced it after two days.  Hannants waited a lot longer.  I put in my order on the 13th.  If they had told me about the problem on the 14th or 16th, I wouldn't have been anywhere as frustrated and disappointed with them as I am now.

Later,

Dave

[IanHx]

6 hours ago, e8n2 said:

Look at my original post about how Tylenol handled a bad situation.  Not being upfront about situations will end up costing you more in the long run than putting it right out there to begin with.  Tylenol is still a multi-billion dollar company.  The RM are the one's who got the cyber attack.  They announced it after two days.  Hannants waited a lot longer.  I put in my order on the 13th.  If they had told me about the problem on the 14th or 16th, I wouldn't have been anywhere as frustrated and disappointed with them as I am now.

Later,

Dave

 

There's a key difference between Tylenol and RM ransomware attack :

* with Tylenol the damage was done, nothing to gain from hiding it.

     with RM, I suspect the delay was while they assessed whether they could recover or not.

      Mind you Royal Mail are skint anyway so a very poor choice of ransomware target.

 

Not that I condone such a delay, the number one rule we are taught is "never ever pay up".

 

 

Reading back though, I see your complaint is not with Royal Mail taking days to announce the ransomware attack,

but with Hannants continuing to use them after this was general knowledge.   I can see something on their website now, whether they could have been quicker in hindsight - who knows ? Entirely possible the dispatchers hadnt heard on the 13th.   Not their fault their supplier let them down, and its not like they're a big organisation with hundreds of staff who could email all their customers saying "sorry, our logistics partner has let us down, there's a delay ".  If the parcel had already left the building, then isnt even the opportunity to contact customers to ask if they want to pay more for courier delivery instead.

 

Sure, a delayed shipment is annoying, but put the blame where it belongs -  on the Russian criminals responsible for the cyberattack.

 

 

 

[Ratch]

I put the blame solidly on RM. I'm a mail buddy for someone in Oz. The first we knew of it was last week when I took his package round to my Post Office, to be refused. I was told to check the RM website. On Friday it appeared that the warning had gone, so I took the package round again, only to be told the same thing.

It's more than about time RM had this sorted 😡

[IanHx]

3 minutes ago, Ratch said:

 

It's more than about time RM had this sorted 😡

 

Agreed !

[e8n2]

17 hours ago, IanHx said:

Sure, a delayed shipment is annoying, but put the blame where it belongs -  on the Russian criminals responsible for the cyberattack.

Russian criminals doing the cyber attack or ransome ware attack are NOT responsible for Hannants not saying word one about the problem until AFTER their customers started complaining.  Again, it doesn't cost them anything, or a lot of staff, to put up a hard to miss notice on their home page, as they eventually did, about RM not taking overseas deliveries because of the attack.  They should have done it as soon as they became aware of it.  Their failure to do so is the problem and could cost them in the long run.

Later,

Dave