Cyber attacks cripple Jaguar, M&S, Harrods—costing UK billions in 2025

Cyber attacks came to the forefront of the business agenda in 2025 (Dave Thompson/PA) Dave Thompson

Major cyber attacks crippled some of Britain's biggest companies in 2025, causing billions in losses and marking what experts call a "tipping point" in the nation's vulnerability to digital threats. Jaguar Land Rover, Marks & Spencer, Harrods, and Co-op all suffered devastating breaches that exposed the profound link between cyber security and economic stability.

The attacks inflicted unprecedented damage. Jaguar Land Rover halted production across all UK factories for five weeks from September, leading to a revenue plunge of more than £1 billion for the quarter and pushing the company into heavy losses. The shutdown was cited as a key reason for the UK economy contracting in September and October.

Marks & Spencer's breach around Easter weekend stopped online orders for approximately six weeks, costing the retailer £324 million in lost sales. Customer personal data including names, email addresses, postal addresses, and dates of birth was stolen. The company recovered £100 million through an insurance payout. Logistics system disruptions caused empty shelves across stores.

Widespread data theft

Co-op suffered data theft affecting all 6.5 million of its members. Harrods also faced a damaging cyber attack during the year, though specific details of the luxury retailer's losses were not disclosed.

The scale of the threat has grown dramatically. The National Cyber Security Centre handled 204 "nationally significant" cyber attacks in the year to September, compared to 89 incidents the previous year. Global ransomware attacks reached record levels, with 590 in January and 886 in February, according to cyber security company NCC Group.

Economic impact warning

Andrew Bailey, governor of the Bank of England, identified cyber attacks as one of the biggest threats to UK financial stability. The Cyber Monitoring Centre, a non-profit organisation, estimated the Jaguar Land Rover incident as the «financially damaging cyber event ever to hit the UK», costing the national economy around £1.9 billion.

Mike Maddison, chief executive of NCC Group, said 2025 «served as a tipping point». He explained: «Cyber attacks are far from new, but 2025 has shown just how deeply cyber risk is intertwined with economic stability and business continuity.»

«Compared to previous years, these attacks have been more far-reaching and costly, reaffirming that cyber security is no longer just an IT concern», Maddison stated. «CEOs and government leaders should now be acutely aware that cyber resilience is fundamental to the UK's long-term growth and resilience.»

Future threats

Maddison warned the spike in attacks «should be seen as a clear warning, not a one-off peak». He said: «Supply chains will remain prime targets, as their complexity means disruption can spread quickly across sectors, intensifying the pressure to pay ransoms.»

A survey by insurer Hiscox of 5,750 global businesses earlier this year found 59 per cent of small to medium businesses experienced a cyber attack in the past 12 months. Among those who paid ransoms, 60 per cent recovered some or all data, while 31 per cent faced demands for additional payments.

Government response

The Government is developing a Cyber Security and Resilience Bill to empower regulators to fine non-compliant companies. New proposals from the Home Office will mandate businesses to notify the Government before paying ransoms and ban public sector bodies and critical national infrastructure operators from making such payments.

Cyber criminals are increasingly utilizing artificial intelligence for phishing attempts and identifying system vulnerabilities. Ransomware refers to software used by criminals to access, encrypt, or steal data from computer systems until a ransom is paid.

Note: This article was created with Artificial Intelligence (AI).