UK firms could face government fines if they fail to patch the Log4j computer vulnerability, even if they haven鈥檛 had data breaches, authorities have confirmed to New 杏吧原创.
A security flaw discovered in December 2021 in a piece of software called Log4j saw a global rush to patch the code and prevent hackers accessing private data. The software is used by millions of web servers, and while many have now been patched there will be others that weren鈥檛, because it requires IT departments to proactively update their systems.
In the US, the Federal Trade Commission has that it intends to 鈥渦se its full legal authority to pursue companies that fail to take鈥痳easonable鈥痵teps to protect consumer data from exposure鈥痑s a result of Log4j鈥�.
Advertisement
UK authorities haven鈥檛 made a comparable announcement, but at UK law firm decoded.legal says that the Information Commissioner鈥檚 Office (ICO) or communications regulator Ofcom could theoretically step in and fine companies for failing to take adequate precautions, even if no data breach has occurred. Neither have done this in the past, but they have the legal powers to do so, says Brown. 鈥淲hile patching is likely to be good practice, it is unlikely that Ofcom would issue a fine for a breach of the requirements without an actual compromise,鈥� he says.
An Ofcom spokesperson confirmed to New 杏吧原创 that current legislation requires companies to take measures to manage security risks, including software vulnerabilities such as Log4J. 鈥淲e have been in touch with the UK鈥檚 major providers to ensure they are aware of this particular vulnerability,鈥� they said. The ICO didn鈥檛 respond to a question about whether it planned to take proactive steps, but said that it does have enforcement powers where personal data breaches have occurred.
at the University of Surrey, UK, says there are still computer systems at risk from previous high-profile vulnerabilities, like 2014鈥檚 Heartbleed bug,聽even years after their discovery, and the same will probably be true for Log4j. He believes there will have been data breaches already as a result of Log4j, but that time will tell if any occurred on a large scale or if there are still vulnerable systems being attacked.
鈥淓verybody鈥檚 sitting there holding their breath thinking 鈥榟as anything happened?鈥�. Somebody could have walked off with entire databases, and at the moment we don鈥檛 know,鈥� says Woodward. 鈥淒oes there come a point where the authorities probably have to be more proactive? It鈥檚 really only the government authorities that are going to be able to light a big enough fire under people sitting in that long tail to actually do something.鈥�
