EXCLUSIVE: The cyber-attack on Prospect, the parent union of film and TV group Bectu, has sparked fears that it could have compromised information pertaining to the UK’s national security.
Deadline revealed earlier this month that the majority of Prospect’s 150,000 members had their data breached during an “IT security incident” in June.
Our original report focused on the impact that the breach had on Bectu members, working across the entertainment industry, but Prospect’s activities are sprawling.
The union represents members in sensitive professions, including at the Ministry of Defence and military suppliers. Prospect also has civil servant members across a variety of government departments.
Data accessed during the breach included bank details, contact details, and “personal identifiers” like birth dates and protected characteristics.
Prospect general secretary Mike Clancy has held online calls with members in recent days, with people grilling him about the cyber-attack and why it took four months to inform members that personal information was compromised.
Deadline has seen a written question from a Prospect member in the Defence Science and Technology Laboratory (DSTL), which develops UK security and defence technology.
“We in DSTL work in national security, some in extremely sensitive roles dealing with current operations. When you found our data had been compromised you should have told us all immediately as our personal security is at risk,” this person said.
Another member told Deadline: “The membership of this union includes top-level civil servants, the defense sector, nuclear sector etc — it’s a national security risk. The data could well end up in the hands of a hostile state actor.”
Prospect has not disclosed who was behind the cyber-attack, meaning the union has not ruled out the possibility of a state actor being involved in some capacity. In conversations with members, Clancy has also declined to confirm whether a ransom has been paid.
A Prospect spokesperson said the union had held talks with employers about the cyber-attack, especially where members “work in sensitive areas.” They added: “These conversations have been constructive and will continue.”
Deadline understands that detectives in the Metropolitan Police’s cybercrime unit are investigating the matter. The UK’s Information Commissioner’s Office (ICO) has also been made aware of the incident. An ICO spokesperson said it is making enquiries with a view to potentially launching a full investigation.
Although Prospect members are upset about how long it took the union to inform them of the personal data breach, one cyber-security source said four months is not necessarily unusual, particularly in complex cases. The ICO states that if a breach affects an individual’s “rights and freedoms,” they should be informed “without undue delay.”
Prospect said: “We take our responsibility to our members incredibly seriously. We worked relentlessly to ensure we knew the precise scope of impact so we could notify those affected, in accordance with our legal obligations, and not cause unnecessary concern to other members who did not need to be notified.
“This required extensive detailed work to achieve and was completed as quickly as possible. Differentiating and identifying impact did take time but this allowed us to provide tailored communications, so members we notified knew exactly how they were affected and the support we were making available to them.”
