A cyber attack on Caerphilly-based ventilation firm Nuaire is being looked at by the Information Commissioner’s Office (ICO).

Caerphilly Observer understands Nuaire is being held to a ransom by computer hackers.

An ICO spokesperson told Caerphilly Observer: “Polypipe Limited/Nuaire (part of the Genuit Group) has reported an incident to us, and we are making enquiries.”

The ICO was unable to confirm when it was informed of the attack, however.

Nuaire’s email and phone systems have been down since at least last Tuesday, with customers unable to contact the firm through usual channels.

Nuaire, which employs around 500 people, is based on Western Industrial Estate and manufactures ventilation equipment used around the world.

The firm, which, celebrated its 50th anniversary last year, is supplying ventilation units for two of the stadiums that will be used at the 2022 FIFA World Cup in Qatar.

Nuaire has explained the outage to customers as a ”technical issue”, although a representative of the firm confirmed to Caerphilly Observer it was due to a cyber attack.

A spokesperson for Nuaire’s parent company, the Leeds-based Genuit Group, said they hope systems to be “up and running in the next few days”.

Staff have been briefed not to speak to the media, with some instructed to stay at home.

What is the Information Commissioner’s Office and what does it do?

The Information Commissioner’s Office was set up in 1984 with the aim of ensuring data protection laws were being upheld. It has been given greater power over the years by the UK Government, which allows it to deal with more cases.

The ICO is funded by the UK Government’s Department for Digital, Culture, Media and Sport. It is not a government department but an independent institution.

This allows ICO the freedom to investigate anyone or any organisation they believe to have broken data privacy laws. This includes UK Government itself, as was the case in December last year, where the ICO fined the Cabinet Office £500,000 for disclosing postal addresses in the New Years Honours list.

A recent example of an ICO prosecution in Wales is when it fined a firm £200,000 for illegally acquiring phone numbers.

According to the ICO, for a full investigation to be carried out, it needs to first gather evidence and assess whether or not it potentially risks the Data Protection Act.