UK Communications Workers Union confirms cyberattack on its IT systems

The Communications Workers Union, a British trade union representing about 185,000 workers in postal and telecommunications roles, confirmed in March 2024 that a cyberattack had disrupted its IT systems.

The union first told members on March 22 that it was dealing with IT problems and that a cybersecurity firm had been on site at its headquarters since the previous morning. It described the incident as an attack on several of its IT systems that had severely affected its infrastructure. Email services were unavailable and some servers were taken offline as a precaution. Officials initially characterised the disruption as an outage before confirming to The Register on March 25 that it was an attack.

The CWU holds membership records including names, postal and email addresses and mobile numbers, and for members who pay subscriptions by direct debit it also holds bank names, account numbers and sort codes. The union said it did not know whether any of that personal data had been accessed and advised members to watch for phishing messages.

The union reported the incident to the Information Commissioner's Office, which confirmed it had been notified, and engaged forensic investigators. It said there was no evidence its backups had been corrupted. A source told The Register that finance, payroll and membership information had been compromised, a claim the CWU disputed. Its head of communications, Chris Webb, questioned where the source had got their information, saying they were "in dreamland" and that they "shouldn't be trusted." No group publicly claimed responsibility.