A ransomware attack affecting some of the U.K.’s largest corporations has highlighted once again how exposed organizations can be if the levels of cybersecurity used by their third parties are not as strong as expected.

Russian cyber hacking group Clop admitted it hacked into a piece of software called MOVEit that businesses use to transfer data files securely both internally and externally.

One of the firms targeted was U.K.-based payroll services provider Zellis, which admitted some high-profile clients—including broadcaster BBC, airlines British Airways and Aer Lingus, and pharma retailer Boots—had personal data stolen.