Jun/Jul 2025 - Threat Intelligence Briefing

Making sense of key incidents – and what they mean for your business

Supply Chain Risk—Outsourced Vulnerabilities Hit Businesses Indirectly

Key Stories

• Retail sector reporting (UK) confirmed attack vectors via extended supply chains—lessons just as relevant for Irish SMEs using outsourced distributors or logistics partners who might be targeted upstream.→ ibec.ie | Think Business

• Irish SMEs noted downtime not from direct breach, but from digital service providers being disrupted, affecting payroll, websites, or finance software availability.→ ibec.ie | Think Business

Why This Matters

You may run good internal cyber practices, but you’re only as secure as the weakest provider you use. If your IT, bookkeeping, or logistics supplier falters, your business can grind to a halt.

What to Do

Action Area	What You Should Do
Dependence Map	Who provides your IT, payroll, logistics—what stops if they go down?
Supplier Questions	“How do you detect and respond to breaches that affect clients?”
Fallback Planning	Define backup plans if key partner platforms fail
Contracts & SLAs	Ensure suppliers notify you promptly of any incident

Ransomware Threat Continues to Escalate

Context

• Expleo reports large Irish firms paid average ransoms of €683k in 2024. While SMEs pay lower, many still suffered repeated attacks.→ Think Business

• Gallup/IFSC survey indicates 33% of SMEs paid ransom, and 25% more than once—with no guarantee of data recovery.→ Think Business

Why This Matters

Paying doesn’t guarantee outcomes—and reputational and regulation risk remains. SMEs often underestimate repeat extortion cycles and the fallout.

What to Do

Action Area	Recommended Action
Backup Discipline	Maintain offline backups. Test quarterly restores.
Incident Playbooks	Designate roles and decision tree for extortion events
Trusted Partners	Pre-vet legal, forensic, PR support providers
Access Governance	Limit admin rights; log and review sensitive access

3. Phishing & Scams—Still the Core Threat

Context

• BPFI data: Irish SMEs lost €17m to invoice redirection emails; nearly 90% have been targeted by scams in past two years.→ Think Business

• Fraud incidents increasingly impersonate senior staff or suppliers—social engineering on the rise.→ Think Business

Why This Matters

These are highly targeted, emotionally urgent scams—often hitting small businesses hardest. €10K+ losses per incident are common even in apparently small exposures.

What to Do

Action Area	Recommended Action
Realistic Testing	Conduct phishing simulations that mimic invoice redirection and CEO fraud
Staff Awareness	Include personal phishing/social media scams in training
Spoofing Monitoring	Watch for fake domains or email lookalikes in circulation
Report Culture	Encourage staff to flag suspicious messages—even if unsure

Patch & Software Hygiene—A Persistent Weakness

Context

• SiliconRepublic survey noted 57% of Irish firms skip regular updates and many lack automated backup routines.→ Silicon Republic

Why This Matters

Neglecting patches and backups remains a top cause of preventable breaches and ransomware incidents.

What to Do

Action Area	Recommended Action
Auto Updates	Enable automatic updates for OS and business-critical apps
Password Hygiene	Use password managers, 2FA, and dark-web monitoring
Endpoint Oversight	Track compliance across both managed and remote devices
Privilege Control	Restrict install rights and regularly review access levels

Regulation—CyFun & NIS2 Are Arriving in Ireland

Context

• On 24 June, Ireland’s NCSC released the draft RMMs and CyberFundamentals (CyFun) framework to align with NIS2 👇→ Gov.ie

• NIS2 is set to become Irish law in Q4 2025, with enforcement starting in 2026. Around 4,000 businesses will be in scope.→ CommSec

• CyFun is designed to help SMEs adopt a structured, evidence-based baseline now—even ahead of mandatory requirements.→ Gov.ie

Why This Matters

Even if you're not yet regulated, clients and partners may require proof of cyber governance. CyFun offers a practical foundation now.

What to Do

Action Area	Recommended Action
Governance Roles	Assign clear accountability for cyber and supply risk
Self-Assessment	Use CyFun to benchmark existing practices
Documentation	Begin collecting incident logs, training records, backup evidence
Strategic Alignment	Plan future supplier onboarding, resilience, and certification initiatives

💡 Final Perspective

These threats are real, local, and escalating—but so is expectation. With clear questions, simple checks, and foundational readiness, Irish SMEs can stay resilient. Sanctuary turns news into actionable insight.