View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
January 6, 2020

NCSC Denies LSE Outage Investigation, Amid Hacker Claims

"Not a cybersecurity incident"

By CBR Staff Writer

The UK’s National Cyber Security Centre (NCSC) today denied claims in the Wall Street Journal that intelligence officials are digging into an August outage at the London Stock Exchange, fearing it may have signalled malicious cyber-activity or the possibility of it.

“The NCSC has not treated the LSE outage as a cyber security related incident and has not investigated it as such”, a spokesman told Computer Business Review.

The WSJ is incorrect, officials said, responding to the August 5 report that said officials were “examining whether a trading outage blamed on a software hiccup at the London Stock Exchange in August may actually have been caused by a cyberattack aimed at disrupting market”; the report claimed Treasury officials were also involved.

Trading on the London Stock Exchange (LSE) was delayed by an hour and 40 minutes following the incident on August 6, 2019; the longest LSE outage in eight years.

LSE Cybersecurity Investigation: “Technical Software Configuration” to Blame

An LSE spokesperson added in an emailed comment: “London Stock Exchange experienced a technical issue on the morning of August 16, 2019 that impacted trading in certain securities for one hour and forty minutes until it was successfully resolved.

“London Stock Exchange takes its commitment to run orderly markets for its members seriously and has thoroughly investigated the root cause of the issue to mitigate against any future incidents.  The incident was caused by a technical software configuration issue following an upgrade of functionality and was not a cybersecurity incident.”

Pressed on whether the NCSC was assessing the LSE’s software supply chain security, a spokesperson said that the agency was “not a regulator”.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

LSE cybersecurity

The incident, which saw trading delayed until 9.40am, was the third major infrastructure outage in Britain in a week.

It followed an IT issue at British Airways that left tens of thousands of passengers stranded, and major power cuts that left commuters in the dark on the Underground, after a lighting strike tripped two major power stations.

(This week Ofgem fined three electricity suppliers – RWE Generation, Orstead and UK Power Networks a combined £10.5 million for that incident).

The LSE at the time blamed the outage on a “technical software issue”. It was reportedly in the middle of updating its systems when the outage happened. With development outsourced to contractors, the WSJ cited concerns about supply chain security.

The WSJ report came amid heightened attention on the cybersecurity of critical national infrastructure, in the wake of rising tensions with Iran.

The NCSC offers a range of security services and guidance to British businesses, including the Cyber Security Information Sharing Partnership (CiSP), a joint industry and government initiative set up to “exchange cyber threat information in real time, in a secure, confidential and dynamic environment”.

Businesses can apply to join the CiSP here.

They will need a sponsor: either a government department, existing CiSP member or a regional Cyber PROTECT police officer or industry champion.


Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.