2025: A Year of Rising Costs—and Escalating Cyber Threats for UK Businesses As 2025 draws to a close, UK businesses and charities have faced a surge in financial pressures—from soaring employment costs and supply chain disruptions to oil and tariff shocks. Yet, one of the most damaging expenses has been the fallout from cyberattacks, which have hit nearly half of British companies and 30% of charities over the past year. High-profile victims include retail giants Marks & Spencer, Adidas, and the Co-op Group, as well as Heathrow Airport, Harrods, and Jaguar Land Rover (JLR). The public sector hasn’t been spared either: Germany’s parliament and the UK Foreign Office (breached in October) were among those targeted. Attacks ranged from phishing scams to full-scale digital shutdowns, with some incidents costing hundreds of millions. The scale of cybercrime has reached staggering proportions. Cybersecurity Ventures estimates the global cost of cyberattacks in 2025 at $10.5 trillion (£7.8 trillion)—a figure that would rank cybercrime as the world’s third-largest economy, trailing only the US and China. The financial and operational toll underscores the growing threat to organizations across sectors.

Co-op, a major UK-based retail and financial services cooperative, fell victim to a ransomware attack by the DragonForce group, resulting in substantial financial costs, prolonged operational disruption, and intense public scrutiny. The attack exposed critical vulnerabilities in their cybersecurity posture, particularly their lack of dedicated cyber insurance coverage for ransomware, exacerbating recovery challenges. The incident led to extended system downtime, hampering business continuity and eroding customer trust. While the exact financial losses were not fully disclosed, the reputational damage was significant, with media coverage amplifying the fallout. The attack underscored the risks of underestimating cyber threats, especially for organizations without robust incident response frameworks or financial safeguards like cyber insurance. The prolonged recovery period further strained resources, highlighting the interconnected financial, operational, and reputational consequences of modern ransomware attacks on large enterprises.

Co-op Group Warns of £120 Million Profit Hit After Sophisticated Cyberattack The UK’s Co-op Group, a 181-year-old member-owned cooperative operating in food retail, funeral services, legal, and insurance sectors, disclosed a significant financial impact from a "sophisticated" cyberattack in April. The breach, which exploited social engineering tactics specifically, attackers impersonating a colleague to gain account access forced the company to temporarily shut down multiple systems to contain the threat. The incident disrupted operations, including food availability in stores, and contributed to a first-half underlying loss before tax of £75 million, compared to a £3 million profit in the same period last year. Revenue also declined by 2.1% to £5.5 billion. The Co-op estimates the full-year profit impact at £120 million, with limited insurance coverage expected to offset only a portion of the losses. While the company had cyber insurance for immediate response measures, it does not anticipate claiming for broader financial damages. The attack’s fallout included a £206 million revenue hit and an £80 million profit reduction in the first half, with an additional £40 million allocated in the second half to strengthen cyber defenses. The Co-op plans to open 30 new stores despite ongoing cost pressures and market volatility. The breach reflects a growing trend of aggressive cyberattacks targeting British organizations, with recent victims including the British Library and London Underground. The Co-op’s response highlights the financial and operational risks of such incidents, even for companies with preparedness measures in place.

Marks & Spencer (M&S), a prominent UK retailer, fell victim to a coordinated ransomware attack linked to the DragonForce cartel and its affiliate Scattered Spider. The incident involved the deployment of DragonForce-built ransomware, leveraging Conti’s leaked source code with advanced encryption (ChaCha20 + RSA) and network-spreading capabilities via SMB. The attack targeted both local and shared network storage, with operators threatening to delete decryptors and leak stolen data if ransom demands were unmet by deadlines (September 2 and 22).The breach disrupted M&S’s operations, risking customer data exposure, financial fraud, and reputational damage due to media coverage. DragonForce’s cartel model—recruiting affiliates like Devman and Scattered Spider—amplified the attack’s sophistication, combining initial access tactics with aggressive data exfiltration. While the full scope of compromised data (e.g., payment details, personal records) remains undisclosed, the incident aligns with DragonForce’s pattern of high-impact extortion, including threats to publish sensitive information. The attack underscores the escalating risks posed by ransomware-as-a-service (RaaS) ecosystems, where collaborative cybercriminal groups exploit enterprise vulnerabilities for maximal disruption and profit.

In 2025, Co-op, a major UK retail chain, fell victim to a high-profile cyberattack that resulted in significant financial and reputational damage. The breach exposed customer data, including email addresses, names, phone numbers, and—critically—passwords in nearly half of the incidents. The attack reportedly cost the company around £300 million in recovery efforts, disrupting operations and eroding customer trust. The compromised records heightened risks of identity theft, with criminals potentially exploiting stolen credentials for fraudulent activities like unauthorized loans or credit card applications. The incident underscored the vulnerability of retail sectors, which accounted for 25% of all breaches in 2025, with small and mid-sized businesses being prime targets. Co-op’s breach aligns with broader trends where attackers prioritize personally identifiable information (PII), with 100% of exposures involving email addresses and 34% including sensitive data like health or government records. The financial strain and operational disruptions positioned this as a severe threat to the organization’s stability, particularly given the scale of data compromised and the direct impact on customers.

UK Organizations Face Rising Ransomware Threats as Cyberattacks Intensify The British Horseracing Authority (BHA) became the latest UK organization to suffer a ransomware attack in early June 2025, compromising multiple servers within its IT infrastructure. While core racing operations and general administration remained unaffected, the incident forced some IT staff to work remotely as authorities worked to contain the breach. The responsible ransomware group has not been identified, with details kept confidential for security reasons. The attack is part of a broader surge in cyber threats targeting Western entities, particularly in the UK. Recent victims include retail giants Marks & Spencer, which fell to the DragonForce ransomware and took five weeks to recover, as well as Co-Op and Harrods, both hit in the past two months. Cybercriminals are increasingly drawn to Western organizations due to two key factors: financial incentives businesses in these regions are more likely to pay ransoms to avoid operational collapse and perceived security gaps, where weak defenses make breaches easier and more profitable. Ransomware tactics have also grown more aggressive. Beyond encrypting data, attackers now employ double extortion, stealing sensitive information before locking systems and threatening to leak it on the dark web if demands aren’t met. In rare cases, they escalate to triple extortion, targeting victims’ customers and partners to inflict reputational damage. As cyber threats evolve in sophistication, the long-term impact on businesses and public institutions remains a pressing concern. The BHA incident underscores the escalating risks faced by organizations across sectors, with no clear resolution in sight.

Marks & Spencer Faces Prolonged Online Disruption Following Easter Cyber-Attack Marks & Spencer (M&S) has revealed that its online services will remain disrupted until July after a sophisticated cyber-attack last month. The retailer, which has struggled with online ordering for nearly a month, expects a gradual return to normal operations over the coming weeks. The attack, which occurred over the Easter weekend, initially disrupted click-and-collect and contactless payment systems. By the following week, M&S had to suspend online ordering entirely, displaying an apology banner on its website. CEO Stuart Machin described the incident as a "highly sophisticated and targeted" breach, with financial analysts estimating a £300 million hit to annual profits equivalent to a third of the company’s earnings. While insurance may cover part of the loss, the impact remains significant. Authorities are investigating Scattered Spider, a notorious English-speaking hacking group linked to previous attacks on the Co-op and Harrods. M&S appears to have suffered the most severe consequences among the targeted retailers. Despite the setback, Machin assured stakeholders that the company would emerge stronger, framing the incident as a temporary obstacle in its broader restructuring efforts.

UK Food Logistics Firm Hit by Ransomware, Disrupting Major Supermarket Supply Chains A ransomware attack on Peter Green Chilled, a key logistics provider for major UK supermarkets, has disrupted order processing for retailers including Tesco, Sainsbury’s, Asda, Waitrose, Co-op, Morrisons, M&S, and Aldi. The incident, which occurred last Wednesday, forced the Somerset-based company to suspend order handling on Thursday, though transport operations remained unaffected. Managing Director Tom Binks confirmed the attack in an email, stating that the firm was implementing workarounds to maintain deliveries while providing regular updates to clients. While existing schedules have largely held, concerns persist among suppliers of perishable goods over potential waste due to delays. This attack follows a recent surge in ransomware incidents targeting the UK retail sector, with Marks & Spencer, Co-op, and Harrods all experiencing disruptions in recent weeks. Phil Pluck, CEO of the Cold Chain Federation, noted a sharp rise in such attacks on food distribution networks, often unreported due to reputational risks. The cold chain sector’s tight timelines and high-volume perishable goods make it a lucrative target for cybercriminals. Security experts warn that supply chain vulnerabilities amplify the impact of such breaches. Richard Orange of Abnormal AI highlighted the risk of follow-on attacks, including vendor email compromise, where attackers impersonate suppliers to steal credentials or redirect payments. Meanwhile, Andy Norton of Armis reported that 41% of retailers have faced increased cyber threats in the past six months, with no signs of slowing. Peter Green Chilled has not yet provided further comment on the incident. A previous reference to Lidl as a client was retracted after the supermarket confirmed it no longer uses the firm’s services.

The UK-based Co-op, a major retail chain, fell victim to a ransomware attack in April, orchestrated by the Scattered Spider group. The incident disrupted critical operations, particularly targeting payment systems, causing widespread chaos in transactions and customer service. While the exact extent of data compromise remains undisclosed, the attack likely exposed customer data—a high-value asset on black markets—heightening risks of fraud and reputational damage. The public nature of the breach, amplified by Scattered Spider’s deliberate publicity, intensified pressure on Co-op to respond swiftly, possibly coercing a ransom payment. The attack underscored the retail sector’s vulnerability, where operational disruptions and data theft create compounded financial and trust-related losses. Given Co-op’s prominence, the incident also attracted media scrutiny, further exacerbating reputational harm. The broader trend of weaponised PDFs and AI-driven phishing suggests attackers exploited advanced tactics, potentially leveraging zero-day flaws to bypass defenses. The attack aligns with a pattern of ransomware groups prioritizing high-profile targets to maximize impact and payouts, even amid a reported decline in overall ransomware volumes.

158-Year-Old UK Transport Firm Collapses After Ransomware Attack Linked to Single Weak Password A ransomware attack, allegedly enabled by a single compromised employee password, has led to the collapse of KNP Logistics, a 158-year-old transport company based in Northamptonshire. The breach encrypted critical data and paralyzed internal systems, forcing the firm into administration and leaving 700 employees without jobs. The incident mirrors a growing trend of cyberattacks targeting UK businesses, with high-profile victims including M&S, Co-op, and Harrods in recent months. Last week, Co-op confirmed that 6.5 million members had their personal data stolen in a separate breach. KNP director Paul Abbott revealed that the attack likely stemmed from hackers guessing an employee’s password, though he has not disclosed the lapse to the individual involved. Meanwhile, Richard Horne, CEO of the National Cyber Security Centre (NCSC), emphasized the need for stronger cybersecurity measures as ransomware gangs continue to escalate their operations. The NCSC has been actively tracking and countering these threats, with recent efforts highlighted in exclusive access granted to investigative teams.

Ransomware in 2025: A Systemic Threat Disrupting Global Supply Chains and Critical Services In 2025, ransomware evolved from isolated IT disruptions into a systemic risk, threatening national supply chains, essential services, and entire industries. Cybersecurity Ventures projects the global cost of ransomware will surge to $275 billion annually by 2031, driven by downtime, data loss, recovery efforts, and lost productivity not just ransom payments. A recent SOCRadar analysis highlighted the top 10 ransomware attacks of 2025, each exposing vulnerabilities across sectors: 1. Salesforce Ecosystem – A SaaS supply chain blind spot exploited for widespread disruption. 2. Oracle E-Business Suite – A zero-day attack leveraging supply chain extortion. 3. Jaguar Land Rover – Britain’s costliest cyberattack, crippling automotive operations. 4. Ingram Micro – A ransomware strike paralyzing global IT distribution. 5. Co-operative Group – A sustained siege on the UK retail sector. 6. PowerSchool – Large-scale extortion targeting the education sector. 7. Synnovis – Healthcare disruption with confirmed patient harm. 8. DaVita – Ransomware striking critical healthcare infrastructure. 9. Asahi Group – Manufacturing halts exposing IT-OT convergence risks. 10. Collins Aerospace – Ransomware grounding European airports. Key patterns emerged across these incidents: - Initial access frequently relied on stolen credentials or social engineering rather than sophisticated exploits. - Supply chain vulnerabilities amplified impact, turning single breaches into cascading failures. - Data theft and operational paralysis often outweighed encryption as the primary damage driver. - Delayed consequences such as regulatory penalties or confirmed human harm surfaced months after the attacks. The incidents underscore ransomware’s growing role as a strategic threat, with far-reaching consequences beyond financial losses.

Massive Cyberattack on Transport for London Exposes Data of 10 Million Customers In one of the largest data breaches in British history, Transport for London (TfL) confirmed that a cyberattack in late 2024 compromised the personal data of approximately 10 million customers. The breach, which occurred between August 29 and September 6, was discovered on September 1, prompting TfL to notify over 7 million customers via email in September those for whom email addresses were available in the exposed dataset. While the attack did not disrupt London’s transport networks, it caused three months of online service outages, resulting in financial losses estimated in the tens of millions of pounds. The stolen data included customer names and contact details, with a smaller subset around 5,000 individuals having bank account information potentially accessed. Investigators linked the attack to Scattered Spider, a notorious cybercriminal collective. Two British teenagers, previously charged in connection with the breach, are set to stand trial in June 2025. The incident reflects a broader surge in cyberattacks targeting UK organizations, with recent victims including Marks & Spencer, the Co-op, and Jaguar Land Rover.

The Co-op Group, a Manchester-based organization, suffered a severe cyber attack in April 2025, resulting in an £80 million hit to its half-year profits (to July 5, 2025), with an additional projected £40 million loss in the second half of the financial year. The attack disrupted IT systems, causing supply chain failures that led to empty shelves in stores for two weeks. Revenues dropped by 2.1% to £5.484 billion, and a pre-tax profit of £58 million in 2024 turned into a £50 million pre-tax loss in 2025, including the £80 million cyber attack cost. The incident wiped £206 million off revenues, though the company maintained liquidity of £800 million and secured a £350 million lending agreement to stabilize finances. The attack coincided with similar incidents at M&S and Jaguar Land Rover, highlighting the escalating threat of cyber disruptions to critical business operations. Leadership emphasized resilience but acknowledged the need for structural improvements, particularly in the Food business, to mitigate future risks.

In late March 2024, the Co-operative Group disclosed that a sophisticated cyber-attack on its network had resulted in the unauthorized exfiltration of customer data from one of its back-office systems. According to an FAQ posted on the retailer’s website, hackers were able to extract names, residential addresses, email addresses, phone numbers and dates of birth belonging to Co-op Group members. Although the attackers did not gain access to more sensitive information such as member passwords, payment card details or transaction histories, the incident nevertheless represents a significant breach of personal data. In response, the Co-op took multiple systems offline and engaged with the UK’s National Cyber Security Centre (NCSC) to contain the incident and begin the recovery process. The breach has prompted the NCSC to issue fresh guidance to the wider retail sector, emphasizing the need for robust multi-factor authentication, vigilant monitoring of privileged accounts, and rapid assimilation of threat intelligence. Senior government figures have described the attack as a "wake-up call" for all organizations to treat cybersecurity as a strategic priority. The Co-op continues to investigate the full scope of the compromise and is notifying affected members while reinforcing its defenses to prevent future intrusions.

The Co-op, a UK-based food-to-funerals group, suffered a sophisticated, multi-stage cyber attack in April, initiated via social engineering (impersonating an employee). Though the attack was contained within minutes, its fallout caused £200M in lost sales (6 months to July), with projections reaching £300M by next year and a £120M annual profit hit. Systems remained disrupted, leading to ongoing operational challenges. The attackers attempted ransomware deployment (4,000 attempts/minute over hours), but malware was blocked. The incident exposed underinsurance gaps, with unrecoverable losses. The Co-op’s H1 2023 results plummeted from a £3M profit to a £75M loss, compounded by higher employee costs. Leadership cited youth disenfranchisement as a root cause of cyber threats and partnered with The Hacking Games for mitigation.

The Co-operative Group (Co-op) suffered a malicious cyber attack in April 2025, resulting in a £80m ($107m) hit to its H1 2025 operating profits, including £20m in one-off costs. The attack caused payment disruptions across retail systems, leading to £206m in lost sales revenue and widespread product shortages. Critical operations, including funeral homes, reverted to paper-based processes, while stores faced empty shelves. The breach compromised personal data of all 6.5 million member customers, exacerbating financial and reputational damage. The incident contributed to a £75m pre-tax loss (vs. a £3m profit in H1 2024), with full-year profit impact projected at £120m. Limited insurance recovery was expected, as coverage applied only to immediate response costs, not long-term losses. The attack exposed vulnerabilities in Co-op’s IT infrastructure, particularly in its Food business, prompting structural reforms. Group revenue declined 2.1% YoY (£5.6bn → £5.4bn), though net debt reduced significantly from £1bn (2021) to £43m. Leadership acknowledged the attack’s severe operational and financial consequences, emphasizing ongoing efforts to mitigate future cyber risks.