‘Highly significant’ cyber-attacks rise by almost 50 per cent in the UK 

The amount of "highly significant" cyber-attacks on businesses in the UK rose by almost 50 per cent since 2024, according to a review by GCHQ’s National Cyber Security Centre (NCSC). 

The review outlines that attacks are classed as highly significant if they have a serious impact on central government, UK essential services, a large proportion of the UK population, or the UK economy.  

The NCSC dealt with 429 cyber incidents in the year to September, with nearly half - a record 204 attacks - being classed as nationally significant. These attacks rose from a total of 89 in the previous years review. 

“Nobody wants to believe their business could grind to a halt following a cyber-attack,” said Dr Richard Horne, chief executive of the NCSC. “But any leader who fails to prepare for that scenario is jeopardising their business’s future. Over the last year, cyber-attacks on household brands have brought the NCSC’s work to the forefront of public consciousness. Empty shelves and stalled production lines are a stark reminder that cyber-attacks no longer just affect computers and data, but real business, real products, and real lives.” 

The review comes after a spate of high-profile cyber-attacks on marquee British businesses in 2025. In August, an attack on Jaguar Land Rover ground all production to a halt and forced the government to provide the company with a £1.5b loan to stabilise its supply chain. Earlier this year, a cyber-attack targeted Marks & Spencer, Co-op and Harrods over the space of two weeks. 

Criminals used a method called a ransomware attack, where malicious software is used to get inside a business’s computer system and steal data, locking it away until a ransom is paid.  

The attacks cost the companies millions of pounds, with criminals stealing the data of all 6.5m Co-op members. In response to the rise in ransomware attacks, the UK Government is planning to ban public sector organisations from paying ransoms to cybercriminals. 

“Despite our swift and effective action to defend our Co-op from the hackers, some of our members’ data was accessed, such as names, contact details and dates of birth,” said Shirine Khoury-Haq, chief executive of the Co-op Group. “The attack has had a significant impact on me, my colleagues and on our members. I will never forget the strain it put on those people making it right, or the concern it has given our members, to whom I answer.” 

The review highlights the growing threat of foreign states in attacks, describing China as a “highly sophisticated and capable threat actor,” capable of targeting a wide range of sectors and institutions around the world. The review also highlighted the cybersecurity threat that Russia, Iran and North Korea pose to the UK. 

North Korea was highlighted as a significant threat, due to the prevalence of schemes that place North Korean IT workers into UK companies to raise money for the government in Pyongyang. 

“The recent cyber-attacks must act as a wake-up call,” said Horne. “The new normal is that cyber criminals will target organisations of all sizes, operating in any sector. From local coffee shops to providers of critical national infrastructure, every organisation must understand their exposure, build their defences and have a plan for how they would continue to operate without their IT (and rebuild that IT at pace) were an attack to get through.” 

The NCSC is encouraging businesses to be “radically transparent” about their cybersecurity, working to identify weak points in their security systems and providing simple, clear answers to common security questions if they are under attack from cybercriminals.