Cyberattacks regularly make headlines in the news. These crimes affect high-profile businesses including retailers, banks as well as individuals. Ian Stuart, until recently the head of the UK arm of HSBC, announced that the bank is “being attacked all the time” by online criminals, with cybersecurity now its biggest expense, costing the lender hundreds of millions of pounds.

The National Crime Agency states that cyberattacks are financially devastating and disrupting to both people and businesses. They undermine the economic stability of the UK and cost the UK economy millions of pounds each year.

Not all cyberattacks are financially motivated. Some are for espionage, and/or operational disruption motives. On 19th January 2026 the UK’s National Cyber Security Centre (NCSC) – a part of GCHQ – warned of Russian aligned ‘hacktivist’ groups continuing to target UK organisations with disruptive cyberattacks.

In addition to using AI to carry out cyberattacks, the use of AI technology connected to company systems, data, and operational technology for tasks leaves any company or organisation using AI technology at risk. It is therefore crucial for any organisation to maintain up-to-date cyber security measures on their AI systems and their dependencies. Whilst AI offers great potential for efficiency and creativity, organisations are strongly encouraged to follow the NCSC’s guidance on deploying AI tools securely, and to protect themselves from cyber threats. In addition the NCSC has developed a minimum standard of cyber security called Cyber Essentials. The self-certification scheme is aligned to five technical controls designed to prevent the most common internet based cyber security threats.

In July this year the Corporate Sustainability Due Diligence Directive ‘CSDDD or CS3D’ came into force. This is a European Union Directive which sets a corporate due diligence duty for larger companies concerning environmental and human rights transgressions.

CSDDD – Who it affects

The directive is applicable to EU and also to non- EU businesses depending on size (see below). The date set by which companies need to comply is staggered (up until the end of July 2029) depending on the size and turnover of the company. Importantly for all companies covered by this Directive is that it encompasses not only the business itself, but also its subsidiaries and the whole of its supply chain, globally.

The EU Commission outlines the following guidelines for those companies that need to comply:

Small and Medium-sized Enterprises (SMEs)

Micro companies and SMEs are not covered by the proposed rules. However, the Directive provides supporting and protective measures for SMEs, which could be indirectly affected as business partners in value chains.

Requirements for Compliance – Due Diligence

Each company affected by the Directive will have an obligation to undertake due diligence and make this part of the corporate strategy. The due diligence needs to take into consideration human rights, climate change, and the environmental impact of their actions and decisions – the findings of the due diligence will be made public.

For more information about the Corporate Sustainability Due Diligence Directive see the European Union website –
Corporate sustainability due diligence – European Commission

For more information about how Page Group can assist with due diligence please do not hesitate to contact us.

The United Nations Office on Drugs and Crime recently issued a paper on Organised Fraud. The paper looks closely at how fraud has changed and adapted with technological changes, how organised crime uses it and the damage it does to people, economies and prosperity worldwide.

The paper created a broad definition of fraud to cover the variety of laws in different countries. It describes it as “fraud that deliberately uses deception by any method or medium with the intent to make a wrongful financial or other material gain and which causes detriment to another”.

It describes an “organized criminal group” as defined in article 2 (a) of the Organized Crime Convention as

The report noted that modern technology has industrialised fraud methodologies that have long been in existence and also automating many laborious processes. In addition the availability of encryption tools played an important role in enabling cybercrimes, anonymizing the fraudsters, all using legally available technology.

In order to combat organised crime, the report recommended a multi -pronged approach:

• Legislation – adoption of clear and robust legal framework (it varies country to country)
• Law enforcement should adopt the following strategies:
 Assessing and Targeting organised Fraud
 Criminal investigation – report notes that in many regions the police are not equipped to address the growth in cyber fraud.
 Disruption – a more proactive approach by law enforcement to disrupt organised crime
 International Co-operation
 Diverse Workforce (in law enforcement) – to improve the poor experience of women and persons from diverse backgrounds in co-operating with the police.
 Intelligence Led Policing – improve the data collection, sharing and analysis to identify patterns, connect separate offences and locate/identify potential suspects.

Prevention

The report noted that: “effective crime prevention is contingent not only on developing more secure systems, but also on equipping the public and business community with the knowledge, awareness and capabilities to defend against fraud. Fraud is highly diverse and continuously evolving, and the effectiveness of education and awareness-raising campaigns lies in public messaging that is succinct and clear enough to influence public behaviours and vigilance”

In addition it recommends the following:

• Better Collection of Data
• Centralized Fraud Reporting
• Integrating Data Sets – the sharing of information between countries is essential to prevent, identify and investigate suspects.
• Public-Private Sector Partnerships – better co-operation between law enforcement and private sector such as the financial institutions and technology companies to help prevent and investigate fraud.

The full report can be found here:

UN Report on Organised Fraud