“A ransomware attack on the group’s IT systems had such a devastating impact that the group concluded it could not continue to trade,” – BBC
KNP Logistics (formerly known as Knights of Old), one of the UK’s largest privately owned logistics firms, collapsed overnight after a devastating ransomware attack in June 2023. One compromised password is all it took to shut down a 158-year-old business and put 730+ people out of their jobs.
The breach allowed attackers to encrypt all of the company’s data and shut down its critical systems, forcing KNP to halt operations. This isn’t just a story about a ransomware attack or a technical failure. It’s a business-ending event and a wake-up call for organizations still relying on password-based security.
What Happened in the KNP Logistics Ransomware Attack?
According to reports, an employee’s password was the reason the attackers gained initial access. Multi‑factor authentication (MFA) was not enabled for remote access systems, which allowed the attackers to move freely across the network. They deployed ransomware that encrypted business-critical data, destroyed backups, and shut down internal operations. The attackers even left ransom notes with messages such as: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead…”
The breach halted 500 trucks and affected over 600 clients who relied on the 3PL services, including warehousing and inventory management, order fulfillment, and distribution, for retail goods, pharmaceuticals, automotive parts, and more. Further, the breach also removed the ability to invoice customers or report financials to creditors, which led the company to file for insolvency in September 2023. Despite having cyber insurance, the payout was insufficient, and the backups were either encrypted or destroyed, making the recovery impossible.
Experts estimate a ransom demand of up to £5 million, which was more than the company could pay. It not only took in a legacy but also disrupted thousands of deliveries, alongside direct revenue loss due to missed delivery deadlines.
How do ransomware attacks start?
Ransomware typically begins with a point of entry that allows attackers to get inside a network or system. In KNP’s case, it was an employee’s compromised password, likely through brute‑force.
But passwords are not the only entry point for attackers. Some of the other execution techniques are:
- Phishing emails that might trick you into clicking a malicious link
- Vulnerabilities such as unpatched operating systems
- Compromised Remote Desktop Protocol (RDP) credentials
- Social engineering tactics like fake updates
- Malvertising
Once the attackers get into a system, they typically will encrypt targeted files, disable backups, and continue to try to gain higher levels of access to control more systems.
Ransomware is a broad attack class, and over time, attackers have evolved with different variants and extortion techniques to increase pressure on victims. Most ransomware falls under crypto-ransomware, which encrypts files and demands a ransom for decryption.
Ransomware Variants
Ransomware comes in various forms, often developed and maintained by different ransomware groups. Each variant has its own unique features, distribution methods, encryption techniques, and attack methodologies. Understanding the major ransomware variants is an essential step to strengthening your organization’s detection, response, and recovery plans.
Some of the variants include:
LockBit: It is one of the most active ransomware groups that operates as a RaaS platform. It is known for its quick encryption and data exfiltration tactics that target large enterprises and critical infrastructure across industries like healthcare, manufacturing, logistics, education, and more.
WannaCry: It is a self-propagating malware that spread globally in May 2017, causing global disruption by exploiting the EternalBlue vulnerability in Windows systems. Its victims include the UK’s National Health Service, FedEx, and Renault–Nissan factories.
Ryuk: It is known for its high ransom demands and is deployed after a network has already been compromised via TrickBot or other trojans. First detected in 2018, its top target sectors include hospitals, city governments, and global corporations.
REvil: It operated as a RaaS group that is known for high-profile attacks and large-scale data leaks. It first made its appearance in 2019, and targeted large enterprises with data exfiltration and double-extortion tactics. Kaseya is one of the most high-profile attacks that affected over 1000 businesses, with a ransom demand of $70 million.
Maze: It emerged in May 2019 and is one of the major ransomware groups to popularize the double extortion technique. The victims of the Maze ransomware include Cognizant, Canon, Fairfax County Public Schools, MaxLinear, and more, with datasets published online.
RansomHub: It is a newer ransomware ecosystem that emerged in February 2024. It operates under a RaaS model and has attacked more than 600 organizations globally. Believed to involve former REvil affiliates, it continued the double-extortion approach, causing data exfiltration and encryption.
Extortion Techniques
These are different strategies used together with existing malware variants to increase victim compliance and pressure them into paying. These tactics have evolved rapidly, disrupting the targeted organizations and their ecosystems.
The common extortion techniques include:
Single Extortion: It is the original ransomware extortion model that focused on encrypting files and demanding ransom in exchange for the decryption key. It was deployed using early variants of WannaCry and CryptoLocker, and primarily affected the victims with operational downtime.
Double Extortion: It is one of the most common methods where the attackers exfiltrate sensitive data before encrypting it and threaten to leak the data publicly. It works for the attackers because data exfiltration creates new risks like reputational damage and legal exposure, which pressure the victims to pay if the ransom hasn’t already been paid. The common actors include Maze, REvil, and LockBit.
Triple Extortion: This is another common technique where the attackers add a third layer of threat, which adds further pressure by launching DDoS attacks or targeting third parties like customers or partners.
Quadruple Extortion: It adds a layer of public, legal, and social pressure where the attackers threaten to leak the data to data protection authorities, press, or publish the stolen data on social media or public forums. This technique can affect the stock prices and lead to reputational damage for the organizations.
Why Are Passwords Still a Security Risk?
KNP isn’t alone; compromised credentials are one of the most common reasons for breaches.
We know that passwords are vulnerable; they can be easily cracked and are often reused across services. When credentials are shared between users, whether intentionally or accidentally, the attack surface expands. Attackers can exploit shared credentials for lateral movement, privilege escalation, or unauthorized data access, especially in environments lacking strict access controls or session monitoring.
Even MFA isn’t bulletproof. Attackers regularly bypass it using adversary-in-the-middle (AITM) phishing kits that can intercept and replay MFA tokens.
Despite security controls, credentials-based systems tend to have a wide attack surface and are often vulnerable to phishing, brute force, or data breaches. Simply adding more security layers to a flawed system doesn’t solve the core issue.
Time-to-crack estimates for passwords of various lengths and characters
Source: Hive Systems
The solution is to reduce reliance on passwords by adopting certificate-based authentication.
What is certificate-based authentication?
Certificate-based authentication uses digital certificates based on asymmetric cryptography that help validate users and devices before enabling them to access a network or system.
These certificates eliminate the #1 cause of data breaches, compromised passwords, while also giving organizations the benefit of :
- Device-bound security
- Non-sharable and non-reusable credentials
- Passwordless authentication
- Encrypted and tamper-proof data
With the private key stored in the device, certificates can’t be guessed, phished, or intercepted over-the-air. Because certificates are securely stored on the device and don’t rely on user-generated secrets like passwords, there’s nothing for the users to forget or manually enter. This not only eliminates friction during authentication but also significantly reduces IT support requests related to password resets, account lockouts, and MFA login failures.
Above all, it removes one of the most common attack vectors, compromised passwords, which helps in improving your organization’s overall security posture against threats like phishing, credential stuffing, and ransomware.
It enables access to the resources only to verified and managed devices when a certificate is present and trusted.
At SecureW2, we help organizations transition to passwordless authentication and certificate-driven infrastructure. We have a robust policy engine, which allows you to have agility in your environment and update access as users, devices, or policies change.
Whether you’re managing thousands of students, remote employees, or a healthcare provider, our platform enables:
- Elimination of credential theft
- Support ticket reduction by 20%
- Cloud-based RADIUS authentication
- Real-time signal-based dynamic threat response
- Easy and quick onboarding
- Passwordless Wi-Fi and VPN access
- Certificate lifecycle management
And this is not all, our solutions are cross-platform compatible, which implies that they support a wide range of operating systems like Windows, macOS, iOS / iPadOS, Android, and Chrome OS (Chromebooks), making them ideal for mixed environments.
The Takeaway – How Can Businesses Prevent Ransomware Attacks?
KNP’s collapse is a reminder for every organization that passwords or MFA may not be enough to prevent ransomware attacks. This is what happens when identity security isn’t prioritized. What starts small can scale quickly, and a single compromised credential can trigger a breach.
The attack started with a password and ended with the company’s shutdown. But it doesn’t have to be this way.
You can always take steps to prevent ransomware attacks:
- Go passwordless with digital certificates and eliminate the risk of stolen credentials.
- Equip your employees to recognize phishing attempts and other social engineering tactics
- Verify every device and only trust what you can authenticate and control.
- Automate access to critical resources with identity-based controls
Learn how SecureW2 can help you adopt certificate-based authentication to prevent credential theft and ransomware attacks..
Pratiksha Todi