Your money or your data

The WannaCry ransomware that infected NHS and other computer systems has woken the population – and trustees – up to just how real such a threat is.

It was only the discovery of a ‘kill switch’ – an inbuilt stop button the creator hid in the code – that stopped the virus from spreading. (Click here for more on cyber security.)

Richard Butcher, PTL’s managing director, recently admitted that a few days before the hack, he had wondered whether cyber risk was overhyped.

But figures show it is not. Cyber crime now accounts for nearly half of all UK crime according to the Office for National Statistics, a reflection of just how much of our daily lives – and financial actions – rely on computers and code.

The fact that no UK pension scheme has fallen victim to an attack so far is no real consolation. It will be a matter of time, unless trustees take cyber issues extremely seriously.

The National Cyber Security Centre said that in the first three months of its existence it dealt with 188 incidents serious enough to warrant its involvement. The use of cyber extortion has gone up, and criminals increasingly target specific organisations where the rewards can be greater.

But there are many ways in which a hack can affect the institution that falls victim; apart from leaking or encrypting data to sell or demand ransom, hackers also often tamper with data, according to the NCSC. This could lead to longer-term problems for schemes.

Data security will also move up trustees’ agendas as the EU prepares its General Data Protection Regulation, which comes into effect in May next year. Under this rule, requirements for pension schemes on obtaining member consent for data will be tighter, even when the UK has left the EU.

And while cyber criminals might not go away anytime soon, trustees can and should make it hard for them to get what they are after.

Sandra Wolf is editor at Pensions Expert. You can follow her on Twitter @SandraCWK and the team @pensions_expert.