How ransomware crippled KNP Logistics Group - and what the public record supports

What is firmly on the record

KNP Logistics Group was a Kettering-based haulage and logistics group that traded under several names, including Knights of Old and Nelson Distribution. Its administrators, FRP Advisory, described it as one of the UK's largest privately owned logistics groups. The Akira ransomware gang listed the group as a victim in June 2023. In late September 2023 the group entered administration and about 730 employees were made redundant.

One part survived. Kinaxia bought the trade and assets of Nelson Distribution shortly before the administration, and its 170 staff transferred with it. Knights of Old, KNP Logistics Group, Steve Porter Transport and Merlin Supply Chain Solutions went into administration.

The administrators were measured in what they said. They described a major ransomware attack that affected key systems, processes and financial information, and that hurt the group's finances and its ability to secure investment and funding. Their joint administrator said the business was unable to continue without urgent investment, which the attack prevented it from securing. They also referred to challenging market conditions, so the attack is presented as a decisive factor rather than the only one.

Why a June attack became a September insolvency

Encryption is the part everyone pictures, but the administrators' wording points elsewhere: key systems, financial information and access to funding. A logistics group runs on tight cash cycles, with fuel, wages and vehicle finance paid weeks before customers settle invoices. When finance systems and records are disrupted, invoicing slows, management accounts become unreliable and anyone being asked for money wants to see numbers that no longer exist in a trustworthy form.

That is our reading of the administrators' statement, not a documented chain of events. It fits, though, with the reported detail that the firm needed urgent investment and could not secure it. The most recent accounts reported for the group, for the year to 31 May 2022, showed turnover of £94.5m and a small pre-tax profit of about £1m. On paper this was not an obviously failing business a year before the attack, although accounts that old say little about its position in mid-2023.

One secondary report, paraphrasing a director, says backups and alternative ways of working existed but that critical financial records were destroyed, which blocked bridging finance and a sale. We have only seen that in a single outlet's paraphrase, so we would not lean on it. It is still the pattern worth testing in your own business: having backups is not the same as being able to reproduce the records your lender, auditor or buyer will ask for.

How the attackers got in: reported, not proven

Press coverage from July 2025 says the intrusion began when someone guessed an employee's password, and that this was relayed by a company director speaking to the BBC. One outlet adds that multi-factor authentication (a second check, such as an app approval, on top of the password) was not in place; another report of the same interview does not mention it. We could not retrieve the original BBC interview, and the administrators' statements from 2023 say nothing about the entry method. A director's recollection also describes what the firm believed, not necessarily a forensic finding.

The same coverage reports that the firm had cyber insurance and followed standard IT practice, and that negotiators estimated a demand of up to £5 million that the firm could not pay. The ransom note reportedly named no figure, so that estimate comes from unnamed third parties. We would treat the amount as unconfirmed.

It helps to separate this incident from the wider picture. A joint advisory from CISA, the FBI and partners on Akira, first published in April 2024 and updated in November 2025, lists the usual routes in: VPNs without multi-factor authentication, exploited vulnerabilities, remote desktop exposure, phishing and misused valid credentials. That advisory post-dates the KNP attack and does not mention KNP, so it tells you what Akira affiliates commonly do, not how this particular intrusion happened.

What to do with this, in order of urgency

None of the actions below depends on knowing exactly how KNP was breached. They are the controls that national guidance consistently puts first, ordered by how quickly they reduce risk and how easily they can be reversed.

• First, put multi-factor authentication on every route in from outside: email, VPN, remote desktop gateways and any admin portal. The NCSC says to enable it at all remote access points, and CISA's Akira advisory calls for phishing-resistant methods where possible. This is quick, reversible and covers the single most-reported failure in this case.
• Next, make password guessing expensive. CISA recommends long passwords of 15 to 64 characters and lockout after repeated failed sign-ins, and advises against frequent forced resets. A guessed password only works when nothing slows or flags repeated attempts, so check that failed sign-ins on your remote access service actually raise an alert someone reads.
• Then look at your backups the way an attacker would. The NCSC advises keeping offline copies separate from the network, not relying on a single backup product or location, testing restores regularly and scanning backups before restoring. It also says the backup administration account should have multi-factor authentication that is not on the same device used to administer backups.
• Finally, test the part KNP's public story suggests is easy to miss: could you reproduce your financial records, debtor and creditor positions and payroll for the last year if every server disappeared? Ask your accountant or finance system supplier how long that would take, and write the answer down. That is the evidence a lender or buyer would be waiting for.
• Cyber insurance is worth having, but KNP's reported experience is a reminder that a policy does not stop a funding gap while systems are down. Check what yours covers in terms of lost income and for how long, and whether it expects specific controls such as multi-factor authentication to be in place.

What we still do not know

The public record does not tell us the confirmed initial access method, whether data was stolen as well as encrypted, whether the firm engaged an external incident response team or law enforcement (the administrators' spokesperson did not answer that when asked), or whether the Akira decryptor Avast released in July 2023 would have worked for the systems affected. Commentators have said it is unclear whether KNP could have used it.

We also cannot say how much of the collapse was the attack and how much was market conditions and the group's wider finances. The administrators say the attack was a major factor. We would be wary of anyone who claims one weak password, on its own, destroyed a 158-year-old company: the evidence supports a narrower point, which is that a plausible single entry point met a business with limited ability to recover its financial picture quickly.