Initially the news coming out of Manchester United on the “sophisticated cyber-attack”, attempted last week gave the impression that the club’s security measures had thwarted the breach before it could do any real damage. It has now become apparent that was not the case.

Systems have not, it is now clear, been down since last week to stop the ransomware attack burrowing deeper. Rather, they have been crippled by the cyber criminals. It would also appear the hackers did manage to access sensitive information. Reports today suggest the club, which has been deeply embarrassed by the situation, will now hand over millions to cyber criminals to prevent the pillaged information being published online.

In a ransomware attack, cybercriminals infect a computer network by entering through a vulnerable spot. That could mean infecting the personal computer or smartphone of someone with access to the system. When they connect, the ransomware finds its way into the system, creating havoc. Hackers typically block access by changing logins and passwords from the inside and often also steal data. A ransom is demanded in order to hand back access and hand over data files.

Ransoms are often requested in a cryptocurrency such as Bitcoin, which is then hard for the police and other authorities to trace. In most cases cybercriminals do honour the terms of the ransom on the understanding that if they do not, future demands made by hackers, including themselves, will be less likely to succeed.

Manchester United announced last Friday that their systems had been compromised and the UK’s National Cyber Security Centre is now helping the club. The club also informed the Information Commissioner’s Office of a data breach.

Not having access to its systems is proving hugely disruptive for the business, whose staff cannot even use official emails. One silver lining is that match-day systems appear unaffected and two games have gone ahead at Old Trafford since last Friday. Scouting intelligence is believed to be among the information feared compromised.

Cybersecurity specialists have been recruited by the club in an effort to resolve the problem and staff are also being put through cybersecurity training in an effort to prevent similar situations in future. Forensic tracing processes are trying to understand more about how exactly the attack happened.

It isn’t thought that any personal data, either on supporters or players and staff, has been compromised. It’s that announcement that initially gave the impression the attack had been blocked before doing any serious damage. However, it appears that isn’t the case and the breach was at least successful enough to provide the leverage to demand a ransom of millions.

A club statement read:

 “Following the recent cyberattack on the club, our IT team and external experts secured our networks and have conducted forensic investigations. This attack was by nature disruptive, but we are not aware of any fan data being compromised. Critical systems required for matches at Old Trafford remained secure and games have gone ahead as normal.”

While a sports club may not seem an obvious target for cyber criminals, Manchester United is also a multi-billion businesses. And in fact, a report released by the National Cyber Security Centre last year said at least 70% of major sports organisations are targeted by hackers at least once a year.

The report detailed an unnamed Premier League club that came within a whisker of losing £1 million to cybercriminals who managed to hack the managing director’s email during a transfer negotiation. Another club in the English Football League had to cancel a game after a cyberattack saw its turnstile system disabled and another unnamed sports organisation lost £4 million to a breach.

In fact, the NCSC said sports organisations are twice as likely to be targeted by hackers than other UK businesses.

David Castaneda of London-based cybersecurity start-up CybeX Security comments:

“Businesses and other high-profile organisations are increasingly realising that investing in cybersecurity is now as necessary as having a physical security firm secure their premises. Whether it’s done or not should no longer be considered an option by any business that doesn’t want to risk serious consequences. Digital security systems are also only one aspect to an effective approach to cybersecurity. Staff have to be trained in how to not offer cybercriminals an easy way in.”