Global IT incident highlights importance of cyber security for pension schemes

This is relevant to pension schemes because many member portals, administration systems, and pension-related web applications could well be using PHP either directly or indirectly. Trustees and providers should (if they have not already done so) take action to ensure the immediate risk is addressed. This incident also serves as a timely reminder to focus on cyber risk management more broadly, at a time when AI is exacerbating, and at the same time alerting us to, the cyber threat.

This briefing looks at immediate actions to address the PHP incident and at cyber risk management for pension schemes more generally. It also reminds trustees about the Pensions Regulator’s (TPR’s) AI plan.

PHP: what happened?

PHP (PHP Hypertext Preprocessor) is an older programming language which is widely used across the internet. An AI agent discovered vulnerabilities within PHP that could potentially be exploited to gain unauthorised access to systems. The UK's National Cyber Security Centre (NCSC) and others warned of critical security issues arising as a result. 

Security fixes or “patches” are now available - but they have to be applied. Many government, banking and other websites shut down temporarily to apply the patches

PHP: immediate actions for schemes

The supply chain can be the weakest link in the cyber resilience of a pension scheme. Trustees and providers should ask their suppliers to confirm that they and any relevant sub-contractors: 

1. have applied the security fix for the vulnerability (which has been released and is available)

2. are planning to apply the fix (if so, by what date) and are applying temporary risk mitigations in the meantime, or 

3. are not affected by this risk

They should also check for any indicators of compromise. For more information, see the NCSC website.

They may also wish to ask the same questions of anyone else they share scheme data (personal data and/or wider scheme information) with. Reputational risk for a scheme and its sponsor can arise in a wider range of situations than just where the scheme has legal risk.

The bigger picture: why is cyber risk management so important for pension schemes

It is not yet clear whether any major hacks have taken place as a result of the PHP incident but this is a stark reminder to pension schemes of the need to focus on cyber risk management. They are a target for cyber-crime for two main reasons:

• they can be held to ransom and/or the scheme’s data can be sold on the dark web, and 

• attackers may wish to gain access to scheme assets and to impact their investments. 

Cyber security for pension schemes needs to be looked at from both the data protection angle (securing personal data) and the wider scheme governance angle (including safeguarding scheme assets and confidential information).

Pension schemes are an attractive target for cyber criminals because they invest large sums of money on behalf of their members. They also hold a high volume of personal data for an extended period of time, including sensitive information such as details of members’ health, national insurance numbers and bank accounts. 

TPR, the Financial Conduct Authority and the Information Commission all agree that cyber risk is a major concern for schemes. TPR’s General Code reinforces the duties to protect scheme assets, members and their data and makes express reference to the importance of complying with data protection law. It includes specific modules on maintaining IT systems and having appropriate cyber security measures and procedures in place.

Governance and accountability for data, cyber and AI risk is fundamentally important to all schemes and their supply chains.

What should pension schemes do?

Effective cyber risk management includes many steps, such as: 

• conducting due diligence periodically on service providers 

• auditing contractual arrangements

• having in place security checklists and schedules of minimum cyber security measures

• ensuring periodic cyber security training for trustees and teams working for the scheme 

All of this needs to be documented so that it can be demonstrated to regulators, and to help defend potential compensation claims from affected members and others if incidents happen.

Pension schemes must also have in place robust policies and procedures that comply with the requirements of the UK GDPR and TPR’s General Code. Cyber and data protection policies are a key part of any scheme’s governance framework, as is a comprehensive incident response plan for dealing with cyber incidents (including personal data breaches).

It is important to rehearse response plans regularly through simulated cyber incident drills, which can identify any weaknesses and ensure that trustees and their advisers, as well as scheme administrators and pension managers, are prepared to act quickly and efficiently in the face of a real cyber-attack.

Reminder about TPR’s AI plan

On a related note, trustees should also be aware of, and take action to implement, TPR’s AI plan which sets out its initial views on how trustees should address the use of AI. It is critical for trustees to understand how AI is being used by their scheme and on its behalf by administrators and service providers, consider the risks and put controls in place. AI tools processing scheme data are increasingly common. Privacy and other scheme documentation, including provider contracts, may need updating as a result.

Trustees should also be mindful of the risk to members posed by AI-driven scams. We expect more detailed AI guidance from TPR in the coming months. There is more on this in our briefing.

We can help

At Eversheds Sutherland we pride ourselves on our ‘one team’ joined up approach. Our people come together to cover the legal and practical implementation challenges faced by pension schemes in relation to governance of cyber and AI risks.

We have full service data/cyber offering for pension schemes, including expert lawyers in data protection, litigation, insurance, contracts, and pensions regulatory matters, together with Konexo, our fully integrated consulting services provider. We run simulated cyber incident scenarios, produce tailored cyber and AI policies, negotiate contract updates and offer AI/data privacy impact assessments (amongst other things). All this is specifically tailored to pension schemes.