A cyber-attack on conveyancing giant Simplify cost the group nearly £7m, newly published accounts reveal, but the company's insurers compensated the firm for lost business.
Simplify, which handles 250,000 conveyancing instructions a year, suffered a major IT systems outage due to a ‘security incident’ in November 2021. It later emerged that an unauthorised third party temporarily gained access to systems relating to certain internal Simplify files. Some of those files contained personal data.
Accounts filed by parent company UKLS Acquisitions Limited for the year ended 31 March 2022 confirm that both the company and the wider Simplify group were the target of a cyber-attack. ‘The resultant restoration of systems required the level of new cases taken in to be significantly reduced for a period of approximately 10 weeks, which has dampened the results for the financial year, which otherwise would have been on track to deliver a record number of completions,’ the report says.
The group ‘fully complied with all relevant obligations required by the Information Commissioner’s Office to ensure that any data or information loss resulting from the attack was appropriately handled. The ICO has subsequently expressed satisfaction that all appropriate steps were taken by the group and the ICO does not intend to take any further action or carry out any further investigations into the group’s handling of the attack.’
Under the heading ‘exceptional items’, the report says the group recognised a one-off cost of £7.3m arising ‘primarily' from the cyber-attack. The group successfully claimed from its insurers in relation to lost business; the report also reveals exceptional income of £6.8m relating to the incident.
Group turnover for the year was £140.3m, of which 90% related to legal services. This includes conveyancing and the Move with Us network of estate agents, which supply residential conveyancing leads to the group.
Simplify posted a group-adjusted EBITDA (earnings before interest, tax, depreciation and amortisation) loss before exceptionals of £1.2m, compared to a £12m profit in 2021. At the operating level, the group posted a loss including exceptionals of £46.4m (2021: £7.6m loss). The 2022 deficit incorporates a goodwill impairment charge of £21.2m (2021: Nil).
Net cash fell from £20m to £6.6m year on year.
Following the impact of the cyber-attack, the group entered into discussions with its funders to ensure the long-term funding and capital structure of the group. Since the year-end, shareholders have injected a further £15m of working capital.
Simplify is owned by private equity investors. Palamon Capital Partners is the major shareholder.
Simplify told the Gazette: 'Simplify prioritised security and the interests of clients and introducers both during and since the November 2021 cyber-attack, which inevitably impacted on our financial performance. We incurred significant costs engaging a leading cyber-response team to assist in dealing with the incident and income was much reduced in the short term as we declined new work while systems were being restored to maximise the service we were able to give to existing clients. That approach has been vindicated by the confirmation that the ICO is satisfied with the steps taken and normal services to thousands of clients every month were restored as quickly as possible.
'Securing long-term relationships with several introducers in this period demonstrates how our services are valued by our partners and customers and the renewed support of our investors is welcomed as we continue to develop our business in line with our strategy for the coming years.'
This article is now closed for comment.
11 Readers' comments