What The British Airways Data Breach Is A Warning About Third Party Cyber Risk
Your organisation can have strong internal cyber security controls and still be affected by a weakness elsewhere in your supply chain.
British Airways' involvement in the 2023 MOVEit data breach is a clear example. The incident reached BA through payroll provider Zellis and software used within that wider supplier chain, demonstrating why third party cyber risk needs to be part of every organisation's security planning.
Table of Content:
What Happened In The British Airways Data Breach?
In June 2023, British Airways confirmed that it was one of the organisations affected by a cyber security incident involving its payroll provider, Zellis.
The incident occurred through MOVEit, a widely used file transfer tool. Attackers exploited a previously unknown vulnerability in the software, affecting organisations around the world.
Zellis confirmed that a small number of its customers had been affected, including British Airways.
British Airways said it notified colleagues whose personal information had been compromised and provided support and advice. Contemporary reporting said the affected information included sensitive employee data.
The incident is older than the recent attacks on organisations such as ASOS, M&S, Co-op and Jaguar Land Rover, but the lesson remains highly relevant: your cyber exposure can extend beyond the systems you directly control.
The Key Lesson: Your Suppliers Are Part Of Your Cyber Security Landscape
Most businesses rely on external organisations to provide essential services. Payroll, HR, cloud storage, customer relationship management, finance software, marketing platforms and specialist systems can all involve suppliers processing or accessing important information.
Every connection can create a dependency. If a supplier experiences a vulnerability or breach, your organisation may also face consequences.
Understand which suppliers hold or process sensitive business, customer or employee information.
Know what access suppliers have to your systems and data.
Include third party services in cyber risk assessments and business continuity planning.
Establish how suppliers will notify you if an incident affects your organisation.
Review supplier access and security responsibilities regularly rather than only at the start of a contract.
Why Third Party Cyber Risk Is Difficult To Manage
Businesses cannot directly control every piece of technology used by every supplier. That makes visibility and preparation particularly important.
Employers need to understand where critical information sits, which systems are essential to operations and what the organisation would do if a supplier reported a breach. Clear escalation routes and accurate records can help teams respond more effectively when time matters.
Vulnerabilities Can Affect Many Organisations At Once
The MOVEit incident also demonstrates the potential scale of a vulnerability in widely used technology. A weakness in one product can affect many organisations and supply chains at the same time.
This is why vulnerability management, software updates, threat awareness and clear communication with suppliers matter. Cyber security teams need to understand not only what is happening inside their own network, but also emerging threats that could affect the technology their organisation depends on.
The Cyber Skills Challenge For UK Employers
The UK Government's Cyber Security Breaches Survey 2025/26 found that 43% of businesses had identified a cyber security breach or attack in the previous 12 months.
Medium and large businesses were particularly likely to report incidents, at 65% and 69% respectively.
Government research published in 2026 also found that 57% of businesses had a basic technical cyber security skills gap. Building practical capability within the workforce can help employers better understand risks, maintain controls and respond when incidents occur.
How A Level 3 Cyber Security Technician Apprentice Can Support Third Party Cyber Resilience
The Cyber Security Technician Level 3 apprenticeship develops practical first line cyber security skills that can support organisations across different sectors. The apprenticeship covers monitoring, security controls, access management, vulnerability assessment, risk assessment, threat intelligence and working with internal and external stakeholders.
Identify threats and vulnerabilities
Apprentices learn about common cyber threats and vulnerabilities and can contribute to vulnerability assessments. This supports a more proactive approach to understanding where weaknesses may exist.
Support digital information risk assessments
Learners develop the ability to contribute to risk assessments, helping organisations consider the potential impact of threats to systems, services and information.
Work with suppliers and other stakeholders
The occupational standard includes working with internal and external stakeholders to support secure and uninterrupted operations. That makes communication and collaboration an important part of the role.
Maintain security controls
Apprentices can support practical controls including patching, software updates, access controls, firewalls and monitoring tools, helping maintain a stronger security baseline.
Monitor and report security events
They also learn to monitor and report information security events and understand when issues should be escalated, supporting a more structured response to potential incidents.
Cyber Security Is A Business Responsibility, Not Simply A Supplier Responsibility
Outsourcing a service does not remove the potential business impact if that service is disrupted or compromised. Employers still need to understand the information involved, the operational dependency and how their own organisation will respond.
A Level 3 apprentice will not replace specialist supplier assurance, legal advice or an organisation's wider cyber strategy. They can, however, add practical capability to the team and help cyber security become part of everyday risk management.
Develop An Existing Employee Or Recruit New Cyber Talent
Employers can use the apprenticeship to develop an existing member of staff who already understands the organisation and its systems, or recruit someone new to build additional cyber capability.
Momentous Learning can support both routes. Our free apprentice recruitment service can help businesses looking for new talent, and we can also help employers understand the funding and incentives they may be eligible for.
Strengthen Resilience Across Your Wider Digital Supply Chain
The British Airways incident demonstrates that cyber risk does not stop at the boundary of your own organisation. Suppliers, software providers and external platforms can all become part of your security landscape.
Developing people who understand vulnerabilities, risk, access, security controls and incident escalation can help your organisation become better prepared for risks both inside and outside the business.
Want to build greater cyber capability within your team? Speak to Momentous Learning about the Cyber Security Technician Level 3 apprenticeship and how we can support existing employees or new apprentice recruitment.
