UK Cyber Incidents Rise for Third Straight Year

The number of cyber incidents in the United Kingdom surged 50% in the past year, with ransomware continuing to be the top threat. National Cyber Security Centre CEO Richard Horne said recent high-profile hacks affecting Marks & Spencer, Co-op and other major retailers exposed supply chain vulnerabilities and are a “wake-up call” to cyber defenders.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Between September 2024 and August 2025, the NCSC recorded 429 incidents – marking an increase for the third consecutive year – and included 204 nationally significant incidents, according to NCSC’s 2025 annual review. 18 of those attacks were “highly significant” hacks affecting essential U.K. services.

Ransomware continued to dominate the threat landscape and affect the country’s economy. The Marks & Spencer breach, for example, cost an estimated 300 million pounds in losses and recovery costs.

NCSC’s Horne said the incidents are an example of the “new normal” that businesses, from coffee shops to critical infrastructure providers, are susceptible to hacks.

“For too long, cybersecurity has been regarded as an issue predominantly for technical staff. This must change,” Horne said. “All business leaders need to take responsibility for their organization’s cyber resilience.”

As regulators released the report on Tuesday, Jaguar Land Rover continued to recover from a cyberattack against the company in September. The estimated cost of the attack, which forced the company to shut down its production units, amounts to millions of pounds per day. To support this major employer, the U.K. government recently announced plans for a loan of 1.5 billion pounds for Jaguar Land Rover (see: UK Government Backs Jaguar Land Rover With 1.5B Pound Loan).

In the wake of financial and social harm to U.K. businesses caused by the hacks, U.K. ministers on Monday urged CEOs and board chairs leading U.K. companies to take the necessary steps to protect their businesses.

“Cyber resilience is a critical enabler of economic growth, so getting this right will promote growth and foster a stable environment for investment and innovation,” the ministers said in a joint letter.

Given the fragility of the British cybersecurity sector, organizations must focus on operational resilience, said Trevor Dearing, director of critical infrastructure at Illumio.

“The longer a business is shut down, the more these losses will accumulate. The lesson from the recent JLR and retail attacks is that true proactivity lies not in prevention, but in identifying risks early and containing breaches quickly,” Dearing said.

The U.K. government is set to move forward with the Cyber Security and Resilience Bill, which will require critical infrastructure operators to patch systems, as well as impose a ban on making ransomware payments (see: UK Government Previews Cybersecurity Legislation).

While the bill would improve incident reporting among critical national infrastructure operators, the U.K. government should work on concrete categorization beyond the 13 identified sectors to support businesses in identifying if they are critical national infrastructure – especially with the interconnectedness of those companies with IT suppliers and third parties, said Nathan Webb, principal consultant at Acumen Cyber.

“Countrywide, we commonly focus on things like utilities without considering other services like transport between niche places,” Webb said. “There’s rarely a business that doesn’t do some kind of business process outsourcing, and it’s even more important for those who are CNI to be doing more stringent checks there.”