The UK’s cyber skills shortage has surged by more than a third in the past 12 months, according to a new report by global recruitment firm Harvey Nash.

The study, which analyzed the current state of the digital jobs shortage, found that cybersecurity is the most sought-after tech skill in the UK. Nearly half (43%) of the 823 UK digital leaders surveyed admitted they had a shortage in this area.

The report was published six months after a government study found the UK’s cybersecurity recruitment pool has a shortfall of 10,000 people a year.

Cybersecurity was followed by big data/analysts (36%), technical architects (33%) and developers (32%) as the most sought-after tech skills for UK businesses.

As well as recruitment, staff retention has been a major challenge for UK organizations in the past year. Four in 10 UK digital leaders admitted they can’t keep key staff in these roles for as long as they would like, as they’re being lured away by the offer of more money. Despite this, just 38% of organizations have redesigned their employee offer to make it attractive to staff in the new hybrid working world.

The figures are especially worrisome given companies are planning to grow technology investment (61%) and headcount (66%) to record levels. Around two-thirds (66%) of respondents admitted they are now unable to keep pace with the rate of change because of the lack of tech skills in their organization.

In response to the talent shortfall, over half (54%) of digital leaders said they are planning to cross-train people from other parts of their organization, and 52% will be offering more apprenticeships over the year ahead.

The report also highlighted the continued lack of women in high-level tech roles, with just 12% of the digital leaders surveyed identifying as female.

Bev White, CEO of Harvey Nash Group, commented: “With businesses planning record levels of digital investment, we could be standing on the verge of a ‘second renaissance’ for technology. Organizations are looking to push their digital transformations further and faster than ever before, putting technology at the very heart of how they operate. This will take them beyond being merely ‘tech-centric’: technology will literally be dispersed throughout the business, everywhere.

“But these ambitions are coming under threat from the acute skills shortages that are now worse than ever before. In fact, businesses face a triple whammy. They lack the supply of skilled resource they need; they have not yet evolved a new and effective employee proposition for the hybrid working world; and the skills they need are themselves changing as technology develops at pace. Digital leaders need to rapidly assess their needs and find solutions if their plans are not to be derailed by this potent cocktail of challenges.”

Cyber-insurance companies appear to be benefitting from a continued surge in prices, even as the frequency of claims falls due to corrective steps they’re taking with clients, it has emerged.

Global insurer Beazley, listed with Lloyd’s of London, said on Friday that premium rates on renewal businesses increased 23% year-on-year in the third quarter, driving gross premium revenue to over $3.7bn.

A large chunk of these price rises come from the firm’s Cyber & Executive Risk Division, which saw rates increase 48% year-to-date (YTD) compared to the same period last year. That means the division accounted for $991m in Q3, almost a third of total premium income for the period.

“I remain excited about the opportunity in the cyber market and with our disciplined and prudent risk selection, our market leading product offering and the ongoing investment in our cyber infrastructure, I believe we are in a great position to capitalize on this,” said Beazley CEO, Adrian Cox.

Prices for cyber-insurance continue to rise despite a “downward trajectory” of claims following remediation work done with customers over the past year, it said.

Although not explained in full, this is the idea that by offering cybersecurity advice to clients, insurers can enhance their resilience to threats through best practice steps. This reduces the likelihood of a successful breach and resulting claim.

According to reports, these trends can be seen more broadly. UK-listed Hiscox reported “significant” quarterly growth in cyber rates last week and a 6% increase in gross premiums YTD versus 2020.

Premiums have been soaring across the US and Europe in response to mounting ransomware attacks, which had led to surging claims. Ransomware was responsible for the biggest volume of insurance claims in the first half of 2020, according to provider Coalition.

Last month, a US Cyber Market Outlook report from wholesale insurance broker Risk Placement Services warned that providers have been “battered” by higher-than-anticipated losses and are now charging far more for less coverage.

A May 2020 report echoed the same story: claiming prices had risen 10-30% in late 2020, and that customers in sectors such as healthcare and education were being offered lower coverage limits.

It would be hoped that as organizations start to build in greater cyber-resilience, and insurers get better at specifying the defensive measures they expect, rates will eventually start to fall.

A Chinese intelligence officer has been convicted of cyber-espionage by a US federal jury, in the first ever case of its kind.

Xu Janun, deputy division director of the Sixth Bureau of the Jiangsu Province Ministry of State Security, was found guilty of conspiring to and attempting to commit economic espionage and theft of trade secrets, according to the Department of Justice (DoJ).

From at least 2013, Xu is said to have targeted experts working for leading aviation companies in the US and elsewhere, including GE Aviation. He persuaded them to travel to China, often under the guise of giving a presentation at a local university. They would be paid stipends and travel costs and encouraged to share sensitive information including blueprints.

Xu, who used multiple aliases such as Qu Hui and Zhang Hui, eventually travelled to Belgium in 2018 to meet a target from GE Aviation who was being groomed to share trade secrets.

However, unknown to Xu, the employee and his organization were already working with the FBI and he was arrested there, before being extradited to the US a year later.

He is convicted of two counts of conspiring and attempting to commit economic espionage, which carry a maximum sentence of 15 years per count and a fine of up to $5m. Xu was also convicted of conspiracy to commit trade secret theft and two counts of attempted theft of trade secrets, which could land him with a maximum of 10 years in prison for each count and a $250,000 fine.

“This conviction of a card-carrying intelligence officer for economic espionage underscores that trade secret theft is integral to the PRC government’s plans to modernize its industries,” said assistant attorney general Matthew Olsen of the Justice Department’s National Security Division.

“This conviction also serves notice that the United States will not sit by as China, or any other nation state, attempts to steal instead of researching and developing key technology. Instead, and with the support of our allies, we will continue to investigate, prosecute, and hold accountable those who try to take the fruits of American ingenuity illegally.”

INTERPOL is still on the hunt for two suspected members of the Clop ransomware gang after making multiple arrests in the summer following a 30-month operation, it has revealed.

In an update on Operation Cyclone, the law enforcement agency said that the two Red Notices had been circulated to all 194 member countries around the world following a request from Korean investigators.

The operation was launched after Clop attacks on Korean companies and US academic institutions, although six of the suspects were arrested in Ukraine in June. Stanford University School of Medicine, the University of Maryland and the University of California are thought to have been among the victims.

It was coordinated from Interpol’s Singapore Cyber Fusion Centre, with threat intelligence provided by private partners Trend Micro, CDI, Kaspersky, Palo Alto Networks, Fortinet and Group-IB — as well as two little-known Korean players, S2W LAB and KFSI.

The operation enabled Ukrainian police to search over 20 houses, businesses and vehicles, and seize property, computers and $185,000 in cash, as well as the six suspects.

However, they’re not thought to be central characters in the Clop ransomware gang. According to INTERPOL, they helped to launder and cash-out the group’s assets and threatened victims with data leaks if ransom payments were not made.

“Despite spiralling global ransomware attacks, this police-private sector coalition saw one of global law enforcement’s first online criminal gang arrests, which sends a powerful message to ransomware criminals, that no matter where they hide in cyberspace, we will pursue them relentlessly,” said INTERPOL’s director of cybercrime, Craig Jones.

Law enforcers have been on something of a roll recently, disrupting the notorious REvil and Egregor groups earlier in the year.

Then, at the end of October, Europol revealed that it had targeted 12 threat actors thought to have used the LockerGoga, MegaCortex and Dharma variants or laundered money for those groups.