Zero-Click Email Attacks: What SMEs Should Check After the Zimbra Warning

The NCSC and international partners have warned about a zero-click phishing campaign targeting vulnerable Zimbra Collaboration Suite software. In plain English, some victims could be compromised by viewing a malicious email, without clicking a link or opening an attachment.

That matters for UK SMEs because it changes the usual phishing conversation. Staff awareness still matters, but training alone cannot stop an attack that exploits the email system itself.

The warning is most directly relevant to organisations using vulnerable versions of Zimbra. The wider lesson is useful for any business that relies heavily on email, shared inboxes, client files, supplier messages or hosted IT systems.

Email is often where invoices, contracts, travel plans, employee data and customer instructions sit. If that system is compromised, the result can be more than an IT fault. It can become a business interruption, data, fraud, reputation and contractual problem.

 

Insurance Implications

Cyber insurance is built around response as much as reimbursement. Depending on the policy, cover may include incident response, forensic support, notification costs, data recovery or business interruption. The exact position depends on the wording and the circumstances.

A zero-click warning should prompt businesses to review the evidence behind their cyber arrangements. If the email platform is self-hosted, who patches it? If it is managed by an IT supplier, what does the service contract say? If monitoring is outsourced, who receives alerts and who acts on them?

The uncomfortable point is that some attacks do not rely on an employee making a mistake. That means the business needs technical controls as well as staff training.

 

In practice, review:

• Whether the business uses Zimbra or another exposed email platform.
• Whether all email and collaboration systems are patched.
• Whether MFA is active for administrator and user accounts.
• Whether old mailboxes and unused administrator accounts have been removed.
• Whether logs are retained long enough to investigate an incident.
• Whether the IT supplier's responsibilities are written down.
• Whether incident contacts are known before something goes wrong.
• Whether the cyber policy wording reflects the systems being used.

 

This is also a supplier question. Many smaller businesses do not manage email infrastructure directly. That is fine, but it does not remove the need to know who is responsible for updates, alerts, backups and recovery.

Where cover gets tested, timing matters. If a business suspects email compromise, it should avoid deleting evidence, preserve logs where possible and check the policy notification requirements. Early contact with the broker can help the business avoid steps that make the claim harder to handle.

The aim is not to frighten staff with another cyber warning. It is to make sure the business is not relying on people to spot every attack when some attacks are aimed at the technology underneath.

 

Speak to Ratcliffes

If this kind of email-platform risk raises questions for your business, call Ratcliffes on 01242 544544 to review whether your cyber cover and response planning still fit. We can help you turn a technical warning into a practical insurance check.

 

Sources

• NCSC, “UK and partners expose Russian state-supported actors for new zero-click phishing campaign targeting Western organisations”, 23 July 2026.
• CISA, “Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite”, July 2026.
• IT Pro, “NCSC issues alert over zero-click phishing campaign hitting enterprises”, 24 July 2026.