One password brought down a 158-year-old company. Here’s how. 

Introduction 

There’s certainly been no shortage of cyberattacks to report in 2025.  

Hot on the heels of the retail cyberattacks which hit UK giants M&S, Harrods, and Co-op, the latest to be reported might actually be the worst of all. That’s because it’s resulted in the collapse of 158-year-old transport company, KNP Logistics Group, and the loss of 700 jobs.  

The straw that broke the camel’s back? One weak password, guessed by a ransomware group, which gave them access to the company’s systems and the ability to cripple them from the inside out.  

How did the KNP cyberattack unfold? 

The collapse of KNP actually took place in late 2023, but has only recently come to light thanks to reporting via the BBC. 

In September 2023, a group of hackers affiliated with the Akira gang correctly guessed an employee’s password and gained access to the internal systems of KNP, previously trading as Knights of Old.  

Once inside, the hackers encrypted KNP’s internal files and demanded a ransom believed to be in the region of £5 million. Employees trying to access dispatch systems, invoicing tools, and even internal email were met with a stark ransom note: 

“If you’re reading this it means the internal infrastructure of your company is fully or partially dead. Let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue.” 

No price was specified, but negotiators estimated the demand at up to £5 million – well beyond KNP’s policy limits. 

Compounding the crisis, the attackers had also corrupted or deleted offsite backups, leaving no way to restore operations without paying the ransom. Within days, 500 lorries stood idle, client contracts unravelled, and staff were sent home as Paul Abbott, the company director, realised recovery was impossible without those passwords and backups. 

How did a single password bring down KNP? 

KNP’s IT posture reportedly met industry standards, and cyberattack insurance was in place. 

And yet, all it took was one employee’s guessable password for hackers to slip in undetected. Once inside, the Akira gang deployed ransomware, encrypted critical data and locked down internal systems. The ransom note above makes it clear: pay up or lose everything. Without the ability to pay the millions the gang demanded, KNP had no choice but to fold. 

This wasn’t a targeted breach at board level – it was a basic credential attack, the kind any organisation can prevent with proper controls in place. Yet that single weak password (“letmein” springs to mind) was all it took to let the hackers slip in and destroy the entire company overnight.  

A stark warning to UK organisations 

If it’s not clear enough, the lesson here is that if a 158-year-old haulage firm can be felled by one flimsy password, no business is safe. 

Ransomware gangs aren’t picky – and they’ll happily target family-run shops, large corporates, and everything in between. Plenty of organisations still treat password hygiene as a “nice-to-have” rather than a frontline defence. But when hackers can breeze in on an easily guessed password like “password123”, it’s clear that old rules no longer apply.  

Of course, the truly sobering thought here is that Akira and its peers are constantly scanning for weak links. They’ll move on to the next vulnerable organisation the moment you slip up.  

Mercifully, there are some steps you can take today to ensure that ransom note isn’t popping up on your screens anytime soon.  

Key steps to stop ransomware in its tracks 

No system is impregnable, but you can make life much harder for attackers by adopting a more layered defence strategy: 

• Enforce multi-factor authentication across all accounts. A stolen password on its own should never be able to grant access to internal systems. See our guide. 
• Strengthen password policies. Be sure to require complex, unique passwords and use a corporate password manager to generate and store them securely. 
• Maintain offline, air-gapped backups. Make sure that your critical backups are air-gapped or write-once, so ransomware can’t reach them. 
• Conduct regular phishing simulations and cyber awareness training. Humans are often the weakest link in the chain, so teach your staff to spot suspicious links, phone-based blagging attempts, and social engineering ploys. 
• Patch and update proactively. Apply critical security updates within days, not weeks, to close known vulnerabilities. 
• Implement endpoint detection and response (EDR). Detect anomalous behaviour early and isolate infected machines automatically. See more. 

Stories like the KNP attack can be sobering reminders that cybercriminals are always active, but there are plenty of ways to keep your business secure.  

To double-check your cybersecurity posture today, just ask your Get Support Customer Success Manager, or call our team on 01865 594000.