Cyber attack: ICO happy with actions taken by Simplify
The November 2021 cyber-attack on the Simplify Group – the country’s largest conveyancing business – cost it £6.8m and also suppressed fee income, its annual report has shown.
Its shareholders have also injected £15m into the business to shore up working capital. Simplify is owned by private equity house Palamon Partners.
Simplify owns multiple law firms and conveyancing brands which between them achieved 135,000 completions in the year to 31 March 2022, 13,000 more than in the previous 12 months – a period which included the end of the stamp duty holiday.
The annual report of its holding company, UKLS Acquisitions, said the work to restore systems after the cyber-attack meant the number of new transactions taken on by the group was “significantly reduced” for 10 weeks.
This “dampened” the financial results and meant the group did not achieve what was expected to be a record number of completions. It did, however, successfully claim from its insurers in respect of loss business resulting from the attack.
The report continued: “The group has fully complied with all relevant obligations required by the Information Commissioner’s Office (ICO) to ensure that any data or information loss resulting from the attack was appropriately handled.
“The ICO has subsequently expressed satisfaction that all appropriate steps were taken by the group and the ICO does not intend to take any further action or carry out any further investigations into the group’s handling of the attack.”
It added that Simplify has since “invested heavily” into increasing its cyber-security resilience and business interruption planning.
Group turnover rose just 3% to £140m in the year to 31 March 2022, while losses trebled from £19m to £57m, in part through recognising a £21m impairment in the carrying value of goodwill following the attack. It spent £6.8m on the cyber-attack and “engaging a leading cyber-response team”.
Aside from conveyancing, 10% of turnover came from outsourced residential sales and ancillary services. The group employs nearly 2,000 people.
Adjusted EBITDA, before exceptional items, went from a £12m profit to a £1.2m loss.
The report said that, following the attack, the group “entered into conversations with its providers of capital to ensure that the long-term funding and capital structure of the group could be preserved and protected”.
As a result, the financial covenants attached to its senior debt facilities were “reset to reflect the change in the group’s financial position”, while the group’s shareholders have injected a further £15m in cash to aid working capital since the year-end.
As at the end of the financial year, the group had an outstanding £68m loan facility from Permira Credit Solutions and drawn down £4m from a revolving credit facility with HSBC.
In a statement, Simplify said that the position of the ICO vindicated its decision to decline new work while systems were being restored after the attack and so maximise the service to existing clients, despite the impact on financial performance.
It added: “Securing long-term relationships with several introducers in this period demonstrates how our services are valued by our partners and customers and the renewed support of our investors is welcomed as we continue to develop our business in line with our strategy for the coming years.”
Leave a Comment