NFSP Ransomware Attack Turns Supplier Email Pause Into a Security-Control Test
The National Federation of Subpostmasters was hit by ransomware after a cPanel-related hosting software bug was exploited. The NFSP was targeted on 30 April, and the Post Office paused some email interactions with the federation while saying branch operations were not affected. The immediate test is whether trusted communications can resume without pushing subpostmasters toward insecure workaround channels.
NFSP Email Pause Shows a Supplier-Side Cyber Risk
The National Federation of Subpostmasters (NFSP) has been hit by a ransomware attack after a bug was exploited in software used by its web hosting provider, forcing the Post Office to pause some email interactions with the federation.
The NFSP was targeted on 30 April, days after a vulnerability in cPanel software was discovered and exploited by hackers. cPanel is a web-based hosting control panel used to manage servers and websites.
NFSP CEO Calum Greenhow said the website was hit by ransomware after the cPanel attack.
He said attackers made “demands for release of our files,” the incident had been reported to the Information Commissioner’s Office (ICO), and his IT team had confirmed no data was lost.
Operational Controls Move Beyond the Victim Network
Ransomware is malware that locks or encrypts files, devices or systems until attackers receive payment.
In this case, the immediate operational impact is not described as a Post Office network compromise, but as a disruption to communications with an external supplier.
A Post Office spokesperson said some interactions and integrations with the affected supplier had been temporarily suspended as a precaution.
The spokesperson added that branch operations were not affected and that no compromise of Post Office networks or applications had been identified.
Post Office Chief Information Security Officer Neil Bennett warned subpostmasters on 22 May that inbound and outbound email between the Post Office and the NFSP had been paused.
Emails to @nfsp.org.uk would not be delivered, and emails from @nfsp.org.uk would not reach inboxes during the pause.
The Reader-Risk Control Is Identity and Channel Discipline
Bennett told subpostmasters not to work around the pause using insecure electronic channels such as personal email, text or WhatsApp.
If telephone calls with NFSP stakeholders were required, he advised validating identity before discussing potentially sensitive information, including turning on cameras.
In an update on 2 June, Bennett said the issue remained ongoing and that earlier guidance had not changed.
The practical question is whether the NFSP and the Post Office can restore trusted communications without creating a secondary social-engineering risk through unofficial channels.
