How easily one weak password led to a cyber attack that sunk a UK business

This wasn’t a case of bad luck or an unstoppable attack. It was the predictable result of security gaps that are all too common in mid-sized businesses. And for companies that think they’re protected by insurance or “good enough” security, the warning is clear: if your defences start with assumptions and end with human error, you’re playing a dangerous game.

“KNP thought they were protected by insurance and basic security standards. But cybercriminals don’t care about what you think you’ve done — they care about what’s actually vulnerable.”

— Tom Hughes, Cyber Security Analyst, Curveball

The investigation into the KNP cyber attack revealed a frustratingly familiar story: the breach began with a single compromised password used by an employee to access remote systems. This credential — weak, reused, or phished — gave cybercriminals a foothold.

From there, the attackers were able to escalate privileges, disable security tools, and deploy ransomware across the company’s core infrastructure. Print operations were halted for weeks, logistics systems were taken offline, and customers began cancelling contracts.

In a matter of days, KNP went from operational to paralysed.

By the time the ransom demand came — reportedly between £4 and £5 million — it was already too late. Even if the company had paid (which it didn’t), trust had been broken. Administrators were brought in. The firm’s 730 employees were made redundant. And yet again, the business world learned the hardest way possible: security failures rarely start with some high-level technical exploit. They start with a single mistake.

The UK’s National Cyber Security Centre (NCSC) continues to urge UK businesses to adopt stronger, layered security measures. Their core advice includes:

• Use strong, unique passwords managed through a password manager.

• Implement MFA (Multi-Factor Authentication) across all accounts, especially for administrators and remote access users.

• Keep backups disconnected from the main network and test recovery processes regularly.

• Adopt a “zero trust” approach, assuming no device or user should automatically be trusted.

Yet even with this guidance, many organisations struggle to implement and enforce these controls consistently. And that’s exactly where Curveball helps.

At Curveball, we know how easily a cybersecurity disaster can begin with a human mistake.

That’s why our team work to eliminate the vulnerabilities that criminals most often exploit:

Enforced strong password policies and credential hygiene
No more weak, reused, or outdated credentials slipping through the cracks.

Passwordless login options with phishing-resistant MFA
Reduce friction for users and eliminate the most common access point for attackers.

Real-time behavioural threat detection
Spot suspicious logins, unusual access patterns, and stop breaches in their tracks.

Zero-trust access control to critical systems
Ensure access is always context-aware, temporary, and least privileged.

User risk scoring based on login patterns and anomalies
Let your security team focus on the users who pose the highest risk before a breach occurs.

Had KNP worked with Curveball, that one weak password would have either:

• Never existed due to enforced password policies, or

• Never provided access thanks to phishing-resistant MFA, zero-trust controls, and real-time detection.

In other words, the attack would have failed before it even began.

Cybercriminals aren’t looking for a fair fight. They’re looking for one mistake, one overlooked system, one user who forgot to change their password.

KNP had contracts, staff, a loyal client base, and nearly £42 million in turnover. But none of that mattered once ransomware took hold. When operations stop, revenue stops. And when trust is broken, customers leave.

Most businesses can’t afford a £5 million ransom. And even fewer can survive the aftermath.

If prevention isn’t your current cyber strategy, it needs to be.

Don’t wait until you’re the next headline. Get ahead of the threat, and stay there.