A West Yorkshire court has sentenced Mohammed Umar Taj, a former IT employee, to seven months and 14 days in prison after he launched a deliberate revenge cyber-attack on his employer shortly after being suspended in July 2022. The sabotage caused an estimated £200,000 in financial losses and significantly disrupted operations for colleagues and clients spanning the UK, Germany, and Bahrain
Unauthorized Network Breach
According to West Yorkshire Police, Taj gained access to his former company’s premises and systems mere hours after his suspension. He reset login credentials and disabled multi-factor authentication, cutting internal staff off and blocking access to clients—affecting critical systems across international operations
Evidence from Phone Recordings
In a startling twist, Taj kept voice recordings of his attack and even discussed the scheme in recorded phone conversations. These chilling admissions were later recovered by the police’s cybercrime division, serving as essential evidence in securing his conviction.
Law Enforcement Response
Detective Sergeant Lindsey Brants stated:
“Taj set out to get revenge […] By doing this he created a ripple effect of disruption far beyond the shores of the UK.”
This case underlines the serious threat posed by insider cybercriminals, as highlighted by ITPro’s Emma Woollacott
Broader Impact and Costs
-
£200,000+ in losses: Including remediation, IT downtime, and reputational damage
-
Global disruption: Clients in Germany and Bahrain were effectively locked out due to compromised multi-factor authentication systems
-
Industry warning: Insider threats now account for nearly half of all reported cyber incidents in recent cybersecurity surveys .
Lessons for Businesses
-
Restrict privileged access: Ensure suspended or terminated staff cannot re-enter systems.
-
Implement robust offboarding: Prompt removal of credentials and physical access is vital.
-
Monitor internal threat behavior: Use tools to flag unusual login resets or MFA changes.
-
Forensic readiness: Logs, voice data, and access records can uncover malicious intent quickly.
