Every article by Lucy Harper. Straight-talking cybersecurity advice for UK small businesses.https://thesmallbusinesscybersecurityguy.co.uk/en-gbhttps://thesmallbusinesscybersecurityguy.co.uk/blog/data-removal-service-questions-uk-director-checklist-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/data-removal-service-questions-uk-director-checklist-2026/Lucy Harper examines what UK directors should ask data removal services before subscribing, using published coverage data and documented service limitations.Fri, 31 Jul 2026 09:00:00 GMTsmb-securityuk-businessdata-protectionvendor-riskbusiness-riskexecutive-securitycompliance-failureLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ico-data-broker-accountability-questions-unanswered-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ico-data-broker-accountability-questions-unanswered-2026/Lucy Harper examines the accountability questions the ICO has not yet answered about UK data broker oversight, using the published enforcement record.Fri, 17 Jul 2026 09:00:00 GMTsmb-securityuk-businessdata-protectioncompliance-failurepublic-sector-securitybusiness-riskexecutive-securityLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-data-broker-director-profile-investigation-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-data-broker-director-profile-investigation-2026/What do UK data brokers actually hold on a small business director? Lucy Harper investigates using public records, enforcement history, and ICO documentation.Sat, 11 Jul 2026 09:00:00 GMTsmb-securityuk-businessdata-protectioncompliance-failureexecutive-securitybusiness-riskpublic-sector-securityLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-patch-not-enough-accountability-audit-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-patch-not-enough-accountability-audit-uk-smb-2026/The patch closed the hole. Attackers got in through a new one. The real failure was not technical. It was the absence of anyone watching the edge.Fri, 26 Jun 2026 09:00:00 GMTsmb-securityuk-businessmsp-securityremote-accessvendor-riskincident-responseLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/marks-spencer-dragonforce-attack-one-year-case-study-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/marks-spencer-dragonforce-attack-one-year-case-study-2026/A social engineering phone call. A password reset. £300 million in losses. The M&S DragonForce attack is the most expensive lesson in UK retail cyber security history.Fri, 22 May 2026 09:00:00 GMTsmb-securityuk-businessincident-responsebusiness-risksocial-engineeringsupply-chain-riskransomware-groupsLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/operation-simcartel-sim-farm-uk-sms-verification-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/operation-simcartel-sim-farm-uk-sms-verification-2026/GoGetSMS sold SIM verification bypass on the open web for years. Europol shut it down. UK banks still rely on the control it defeated.Fri, 22 May 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftcompliance-failuresupply-chain-riskLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/knp-logistics-ransomware-cheap-security-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/knp-logistics-ransomware-cheap-security-2026/KNP Logistics had antivirus, firewalls, backups, and insurance. No MFA. No EDR. One guessed password later, 700 people were out of work and a 158-year-old company was gone.Fri, 15 May 2026 07:00:00 GMTsmb-securityuk-businessransomware-groupsincident-responsebusiness-riskcompliance-failureLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/the-quantum-computing-threat-what-uk-smbs-need-to-know/https://thesmallbusinesscybersecurityguy.co.uk/blog/the-quantum-computing-threat-what-uk-smbs-need-to-know/Quantum computing could break encryption soon. UK SMBs must act now to secure data. Learn the steps to protect your business and gain a competitive edge.Thu, 14 May 2026 14:00:00 GMTquantum computingencryptiondata securitysmall businessLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/supply-chain-cyber-risk-uk-small-business-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/supply-chain-cyber-risk-uk-small-business-2026/6% of UK businesses review their wider supply chain for cyber risk. 94% are flying blind. The most dangerous number in the 2026 Breaches Survey.Fri, 08 May 2026 07:00:00 GMTsmb-securityuk-businesssupply-chain-riskvendor-riskbusiness-riskcompliance-failuremsp-securityLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/jlr-cyberattack-supply-chain-case-study-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/jlr-cyberattack-supply-chain-case-study-uk-2026/The JLR attack cost £1.9 billion. Suppliers six tiers down the chain had no say in JLR's security decisions. They paid anyway. Here is the full story.Fri, 01 May 2026 08:00:00 GMTsmb-securityuk-businesssupply-chain-riskbusiness-riskincident-responsevendor-riskLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/dns-misdiagnosis-compromised-router-case-study-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/dns-misdiagnosis-compromised-router-case-study-2026/Three weeks. Two resolver changes. One compromised router nobody checked. How a UK accountancy firm blamed DNS while the real threat hid.Fri, 24 Apr 2026 08:00:00 GMTsmb-securityuk-businessbusiness-riskincident-responsevendor-riskcompliance-failuresupply-chain-riskLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-bec-invoice-fraud-case-study-vendor-email-compromise-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-bec-invoice-fraud-case-study-vendor-email-compromise-2026/Learn from a UK BEC case study where a property firm lost £12,100. Discover the one free policy that could have stopped it.Sun, 19 Apr 2026 06:00:00 GMTsocial-engineeringsmb-securityuk-businessbusiness-riskcompliance-failurecredential-theftincident-responseLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/domestic-general-complaint-dsar-case-study-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/domestic-general-complaint-dsar-case-study-2026/A household with refrigerated medication says the paid route delivered a worse practical outcome than the free one, and that the later data request became a dispute of its own.Mon, 13 Apr 2026 06:00:00 GMTuk-businessconsumer-rightsdata-protectioncomplaint-handlingvendor-riskLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-insurance-mfa-void-uk-case-study-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-insurance-mfa-void-uk-case-study-2026/A UK business said yes to MFA on their proposal form. The attack came through servers with no MFA. The policy was voided. Lucy Harper investigates.Fri, 10 Apr 2026 11:39:00 GMTsmb-securityuk-businessbusiness-riskcompliance-failureremote-accessincident-responseLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/axios-npm-supply-chain-attack-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/axios-npm-supply-chain-attack-uk-smb-2026/One compromised npm account. Two poisoned packages. 100 million weekly downloads at risk. Who is accountable when open-source governance fails?Tue, 07 Apr 2026 13:00:00 GMTsmb-securitysupply-chain-riskuk-businessvendor-riskbusiness-riskLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/c2k-cyber-attack-northern-ireland-schools-investigation-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/c2k-cyber-attack-northern-ireland-schools-investigation-2026/One attack. One network. 350,000 people locked out. And four days later, nobody will say what type of attack it was.Mon, 06 Apr 2026 10:00:00 GMTsmb-securityuk-businessvendor-riskcompliance-failuresupply-chain-riskpublic-sector-securityincident-responseLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/protecting-your-business-from-virtual-smartphone-scams/https://thesmallbusinesscybersecurityguy.co.uk/blog/protecting-your-business-from-virtual-smartphone-scams/Scammers use virtual smartphones to deceive small businesses. Learn how to protect your business and prevent financial loss.Wed, 01 Apr 2026 07:00:00 GMTFraudScamsCybersecurityLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-essentials-scope-drift-case-study-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-essentials-scope-drift-case-study-uk-smb-2026/By the time anyone at Meridian Advisory noticed the problem, their Cyber Essentials certificate had been renewed four times. Each renewal had covered the same carefully defined scope: two office servers, the on-premises file share, and about fifteen managed laptops. By 2025, the actual business ran on Microsoft 365, a cloud-based CRM, a remote project management platform, and a VOIP system. None of those were in scope. When a credential-based breach exposed client financial data held in the CRM,Fri, 13 Mar 2026 00:00:00 GMTcyber-essentialscase-studyscope-managementuk-smbdata-breachicodirector liabilityLucy Harperhttps://thesmallbusinesscybersecurityguy.co.uk/blog/currys-dsg-breach-victims-no-compensation-uk-case-study/https://thesmallbusinesscybersecurityguy.co.uk/blog/currys-dsg-breach-victims-no-compensation-uk-case-study/Darren Warren asked for five thousand pounds for the distress of having his data stolen from Currys' tills. The High Court struck most of his claim out. Meanwhile, specialist law firms ran "Were you affected by the Currys breach?" campaigns, then quietly closed their books without any settlement. The Court of Appeal confirmed in February 2026 that DSG absolutely had a duty to protect that data. By then, most claimants' limitation periods had expired. This is the story of how 14 million people enFri, 06 Mar 2026 00:00:00 GMTdsg-retail-breachdata-breach-victimsico-enforcementlimitation-periodsgroup-action-claimscompliance-failureLucy Harper