Umbrella company cyber attacks prompt fresh calls for sector regulation to protect contractors

Copycat attacks and identity theft

Apart from suspected ransomware attacks, the industry has also been targeted by fraudsters who clone umbrella companies in the hope of extracting payment from employment agencies and end-clients.

In these attacks, the perpetrators have sought to infiltrate and divert funds from the end-client-to-contractor labour supply chain by imitating and trying to pass themselves off as reputable umbrella companies.

“That’s a completely different kettle of fish to the other type of attacks we’ve seen recently within the umbrella sector, but they can still have huge financial implications for the companies that get targeted,” said the umbrella market source.

These types of attack all follow a similar pattern, whereby a new company is registered with Companies House that has a similar name to an existing umbrella firm, effectively creating a clone of that company.

Individuals working for this clone will then contact employment agencies and end-clients and try to pass themselves off as working for the company they are imitating. 

Typically, this contact will include a notification that the umbrella company being spoofed has changed its banking details, and all future invoices should be paid into a new bank account.

“If the copycat company successfully manages to dupe an agency in this way, that could result in a whole week’s worth of wages – that are supposed to be paid to contractors – going missing,” said the source. “Where some of the big umbrella companies are concerned, we could be talking about millions of pounds going walkabout.”

The Freelancer and Contractor Service Association (FCSA), which counts Giant, Parasol and Brookson as members, issued a warning in September 2021 to the extended contractor labour supply chain about the problem of company clones. This was after it discovered at least 10 of the umbrella companies that make up its membership had fallen victim to the practice.

After this discovery, the FCSA urged employment agencies to tread carefully when receiving requests from umbrella companies about changes to their contact or banking details.

“We would advise any agency dealing with any partner company, where money is transferred, to agree on a clear transfer protocol with their partner and to treat with caution any approach that states that banking arrangements have been altered or bank accounts have changed and that funds should now be diverted to that account,” the FCSA said in a statement at the time.

Data blackouts and the impact on HMRC’s reporting

Whether it is due to ransomware attacks or cloning, any incident that affects the ability of the umbrellas to pay their contractors can also cause problems for these companies when it comes to meeting their legal obligations to report their payroll activities to HM Revenue & Customs (HMRC).

This reporting is done through the PAYE Online service, which is an online portal that employers are expected to use to send payroll information to HMRC. Failing to report this data can result in companies incurring financial penalties, with the size of these depending on the number of employees on their payroll.

Following the attack on Parasol in January 2022, for example, the company issued a series of email updates that said it was unable to run its normal payroll processes, but had introduced contingency measures that meant it could pay contractors amounts that were “broadly in line” with what they were usually paid.

“Please don’t worry if your payment is higher or lower than you were expecting,” the company said in an email dated 20 January. “Once our systems are fully operational and we are able to run a normal payroll, we will make an adjustment for any difference in pay advanced to that which would have been paid normally, in a future payroll.”  

A Parasol contractor, who spoke to Computer Weekly on condition of anonymity, said that with the firm seemingly having to rely on guesswork and assumptions to work out what its contractors should be paid during this period, there were likely to be gaps in the payroll data it reports to HMRC.

Parasol is known to employ at least 13,000 freelance workers, and with many of them paid weekly, the contractor claimed the firm will have a huge backlog of payroll data to share with HMRC in the wake of the attack on its systems.

“I don’t see how they will fix this without manually going through the tens of thousands of records for all those missed weeks,” said the contractor.

Computer Weekly contacted Parasol for clarification on how it has set about meeting its HMRC reporting obligations after the attacks, but at the time of writing, no response had been forthcoming.

Meanwhile, when asked by Computer Weekly what the possible repercussions might be for umbrella companies that fail to meet their reporting obligations, HMRC said it was unable to comment on “identifiable taxpayers” but said it takes “an understanding approach whenever taxpayers find themselves unable to meet their obligations due to unforeseen or exceptional circumstances”.

An HMRC spokesperson added: “We would encourage taxpayers who find themselves in these situations to contact us direct.”

Crawford Temple, CEO of Professional Passport, a company that provides compliance assessment services to umbrella companies, said any contractors concerned with how their earnings are being reported in the wake of the attacks should open up a personal tax account with HMRC.

“If they register for a personal tax account, basically what that does is show them what data HMRC is holding on them for their earnings during that period of the tax year,” he said. “We recommend this anyway for umbrella workers because it helps them spot if a company is doing something in the background that maybe it shouldn’t.”

Expanding on this point, Temple cited examples whereby non-compliant umbrella companies might engage in behaviours that leave contractors out of pocket, by making unnecessary deductions from their pay, for example. 

“There are non-compliant umbrella companies that will send a payslip that is perfectly legitimate to a contractor, but then the HMRC data bears no relationship to what is on the payslip,” he said.

“By creating a personal tax account, they can see what is being reported on their income, and make sure that tallies and matches the payslips they have received. It’s a backstop check for anyone.”

Renewed calls for regulation

While there are workarounds to minimise the disruption and distress these attacks have on the companies involved and their employees, the incidents have prompted another round of calls for umbrella companies to be statutorily regulated.

The aftermath of the Giant Group cyber attack in September 2021 saw contracting stakeholders call on the government to expedite the process of introducing statutory regulation for umbrella firms after years of slow progress on this point.

Back in 2017, the government advised to introduce statutory regulation for umbrella companies by the former interim director of labour market enforcement, Matthew Taylor, and it has come under repeated criticism since then for failing to follow through with this recommendation in a timely fashion.

In December 2021, HMRC, in collaboration with HM Treasury and the Department for Business, Energy and Industrial Strategy (BEIS), announced the launch of a consultation into how the umbrella market works. This move was viewed as a sign that the government was making some moves towards regulating umbrella firms.

This consultation runs until February 2022, meaning regulation will remain some way off for a while yet, but umbrella industry watchers are of the view – with the market coming under increased attack from cyber criminals – that more progress is urgently needed to protect contractors.

“The umbrella company industry’s job is to process people’s earnings, so a cyber attack on these companies has a direct impact on the umbrella company workers,” said Rebecca Seeley Harris, chair of the Employment Status Forum and co-author of a policy paper on umbrella regulation. “It is therefore unbelievable that the industry is still unregulated with so much at stake.

“Although regulation will not stop a cyber attack, it would make sense that there are certain measures taken to safeguard the earnings and also ensuring that these companies have active information security management systems, possibly even ISO 27001.”

Seeley Harris added: “Continuity of business is vital, especially the communications to the workers, so these are all areas that future regulation should focus on. Hopefully, the [HMRC consultation] Call for Evidence will be well responded to and the government can prioritise regulating the industry and protecting the worker.”

Regulation urgently needed

The Loan Charge Action Group (LCAG), which is concerned with campaigning against the government’s ongoing disguised remuneration loan charge policy, is also of the view that regulation is urgently needed to protect contractors working through umbrella companies.

“It is hugely worrying for all those freelance workers who work through umbrella companies that several have suffered cyber attacks, which has led to delays in payment and fears of data breaches,” said LCAG spokesperson Steve Packham.

“This is another example of the challenges of being a contractor, as well as another reason why we need regulation of the umbrella company sector. All contractors and freelancers need to have confidence that any payroll provider will pay them the correct rate, on time, while behaving ethically and with full transparency and paying the correct taxes due.”

Packham added: “It is time the government stopped ignoring this huge issue and made clear how contractors should operate, so avoid all these kinds of unnecessary problems and another loan charge scandal, which happened due to bad legislation and a clear prejudice in Whitehall against freelance workers.”

The All-Party Parliamentary Loan Charge and Taxpayer Fairness Group (APPG) echoed these calls for regulation in a letter addressed to FCSA CEO Chris Bryce, dated 24 January 2022, in which it referenced the reports of FCSA-accredited companies being the target of cyber attacks.

“Considering that many UK workers are reliant on their livelihoods by being paid by umbrella companies, which hold confidential data, including bank account details and other sensitive details, this is hugely worrying,” said the letter, signed by all three co-chairs of the APPG.

“Considering this and the huge sums involved overall, this is surely another reason why regulation of the market – something that the FCSA has told us it supports – happens as soon as possible.”

Strict codes of compliance

At the time of writing, it was unclear whether the FCSA had received or responded to the APPG’s letter, but in a separate statement to Computer Weekly, Bryce said the association’s members “must abide by our strict codes of compliance, which specifies they must follow the highest level of professional and ethical standards”.

He added that the FCSA “continues to liaise with stakeholders and our members to ensure the industry can best protect itself from future cyber attacks, which includes supporting members and referring them to third-party expert advice”.

When it comes to the need for regulation, Professional Passport’s Temple has a different take, and said the recent spate of cyber attacks in the sector highlights a need for better enforcement of the existing rules under which umbrella companies operate.

“Whether an umbrella company is regulated or not, data protection and things like that have standards around them that would apply to an umbrella company in the same way they would apply to any other organisation,” he told Computer Weekly.

“To be honest, regulation is a bit of a red herring. If you look at most of the non-compliance that goes on in the sector – disguised remuneration, tax avoidance, all of that – it’s already breaking existing rules. You don’t need regulation – you need enforcement.”