In 2025, the cyber-threat landscape intensified at a pace that few organisations were prepared for. Attackers used AI-driven impersonation, credential-theft campaigns and supply-chain infiltration to break into businesses at scale. High-profile organisations across retail, manufacturing and critical services faced data exposure and weeks of operational disruption. The incidents across 2025 made one thing clear: the consequences are immediate and costly.
The Cyber Landscape in 2025
Several key trends define the cyber-threat environment in 2025:
-
- AI-enhanced attacks: Around 16% of reported incidents involved attackers leveraging artificial-intelligence tools, for example deepfake voice or video impersonations of executives, automated credential stuffing or phishing campaigns.
- State-sponsored & hybrid actors: Nation-state backing continues to fuel large-scale espionage and infrastructure disruption campaigns, often targeting critical national infrastructure, manufacturing supply-chains and services.
- Business-disabling over data-only attacks: The emphasis shifted from mere data breach headlines to attacks that halt operations, disrupt supply-chains and inflict real economic damage.
-
- Ransomware and extortion + data theft: While ransom demands remain common, 2025 saw more incidents where attackers exfiltrated vast troves of records and threatened disclosure even when systems weren’t encrypted.
- UK-specific threat surge: In the UK, the National Cyber Security Centre (NCSC) reported 204 “nationally significant” cyber-attacks in the year to August 2025, up from 89 the year before.
Marks & Spencer (UK Retailer)
-
Background
In April 2025, UK high-street retailer Marks & Spencer (M&S) suffered a sophisticated cyber incident.
Attack Method
The breach was attributed to the hacking group Scattered Spider (also linked to Lapsus$-style activity). Evidence points to social-engineering (SIM-swap / phishing) targeting a third-party service provider, enabling ransomware-style disruption of online services.
-
Impact
- Online orders were suspended for ~6 weeks; the “click-and-collect” and contactless systems were disrupted.
- The prospective cost to M&S was estimated at ~£300 million+ in lost profit or revenue.
Customer-data exposure: names, email addresses, order histories and dates of birth were taken but no usable payment-card details or passwords.
-
Response
M&S immediately engaged cyber security experts, notified the NCSC and began forced password resets for users.
Lessons Learned
- Online processes are critical: when they go down, revenue stops and customer trust erodes.
- Even if payment data is safe, the brand damage and operational loss are extreme.
Co‑operative Group (UK Food & Retail)
-
Background
Shortly after the M&S incident, the Co-op was hit by a cyber attack in April 2025 that disrupted operations at its ~2,300 stores.
Attack Method
Attackers used social-engineering to gain insider access. The group confirmed that hackers accessed internal systems and member data.
-
Impact
- Stock-ordering systems failed; stores reverted to manual processes, resulting in empty shelves in rural locations.
- The breach exposed personal details for all 6.5 million Co-op members (names, contact info; no financial data).
The first‐half profit was hit by ~£80 million; lost revenue of £206 million. Full-year impact projected at ~£120 million.
-
Response
Co-op shut systems proactively, prioritised “lifeline” stores in rural areas and communicated openly with members and regulators.
Lessons Learned
- Operational-resilience matters: food retail is mission-critical, especially in remote communities.
- Member-data trusts are fragile: even without payment card loss, personal details theft matters.
- Transparent communication helps mitigate reputational fallout.
Jaguar Land Rover (UK Automotive Manufacturer)
-
Background
In August/September 2025, UK car-maker Jaguar Land Rover (JLR) suffered a ransomware attack that halted production at its “smart factories” and impacted its extensive supply-chain.
Attack Method
The hacker group claimed responsibility, pausing production lines globally and impacting suppliers and employees in the UK.
-
Impact
It is regarded as possibly the costliest cyber incident in UK history, with estimated damage to the UK economy of ~£1.9 billion.
Thousands of jobs in the supply-chain were at risk; production lines shut for weeks.
Response
A forensic investigation is ongoing; production restart is phased; government statements note the broader impact on GDP.
-
Lessons Learned
- Cyber risk for manufacturing is not abstract — production lines, physical goods and jobs are at stake.
- Extending architectural thinking from IT systems to OT/industrial control systems is critical.
- Supply-chain resilience must include cyber-risk as a core component.
Asahi Group Holdings (Global Beverage Manufacturer)
-
Background
In early 2025, Asahi Group Holdings — one of the world’s largest beverage producers — experienced a cyber attack that forced several production facilities across Europe and Asia to halt operations for multiple days.
Attack Method
The incident was linked to a highly coordinated ransomware campaign targeting industrial systems. Attackers infiltrated Asahi’s network through a compromised supplier account, enabling lateral movement into operational technology environments.
-
Impact
- Production stoppages across multiple bottling plants resulted in significant supply shortages in key markets.
- Logistics and distribution systems were disrupted, delaying shipments to retailers and wholesalers.
- Asahi reported material financial impact due to lost production, emergency remediation costs and supply-chain delays.
-
Response
The company isolated affected OT systems, rerouted production to unaffected sites where possible and brought in global cyber security specialists to contain the breach. Public communication emphasised transparency around supply chain delays.
Lessons Learned
- Supply-chain compromise remains one of the most effective routes for penetrating large global organisations.
- OT/ICS environments are increasingly prime targets for ransomware groups seeking maximum operational leverage.
- Business continuity plans must account for global, multi-site operational disruptions triggered by cyber incidents.
Qantas Airways (Australia)
-
Background
In June–July 2025, Qantas disclosed a major cyber incident affecting its customer-service systems, traced to a third-party call-centre platform.
Attack Method
Attackers gained access via a third-party vendor compromise, likely using social-engineering tactics. Qantas’ core flight-operation systems were not breached.
-
Impact
- 5.7 million customer records exposed (names, contact details, dates of birth, frequent-flyer numbers).
- No evidence of stolen passport details, login credentials or payment data.
- Data later appeared on criminal forums, increasing phishing-risk for customers.
- No disruption to flight operations, but significant reputational and regulatory impact.
-
Response
Qantas engaged external cyber-forensics teams, notified Australian authorities, and contacted affected customers. Support channels and guidance on protective steps were issued.
Lessons Learned
- Third-party weak points can compromise millions, even when core systems remain secure.
- “Non-financial” personal data still carries high fraud and phishing risk.
- Clear, early communication is essential for customer reassurance and trust recovery.
Emerging Patterns and Lessons for 2026
Having reviewed major incidents, what themes and take-aways emerge that organisations should embed into strategic planning for 2026?
Recurring Themes
- “Access is enough”: Attackers often don’t need to break deep; gaining valid credentials is sufficient.
- Business interruption > data leakage: The cost of halted operations now routinely exceeds the cost of data-theft alone.
- Digital-physical convergence: Manufacturing, retail logistics and supply-chains are now cyber-risk zones.
- Generative-AI tools accelerate threat actors: Gaming of systems via AI, deepfakes and automated orchestration raise the stakes.
From DTP’s head of Cyber Security
- Adopt a zero-trust mindset: Assume internal credentials may be compromised; apply least-privilege, monitor lateral movement and enforce MFA everywhere.
- Strengthen third-party risk management: Map critical dependencies, enforce security standards with vendors and perform audits of SaaS and supply-chain access.
- Embed cyber-resilience in business continuity plans: Plan not just for data-loss, but for systems-downtime, manual operations and supplier disruption.
- Elevate OT/ICS security: If your operations touch manufacturing, supply-chain, retail or logistics, include OT/ICS in risk assessments and incident-planning.
- Prepare for AI-amplified threats: Train staff to recognise deepfake, social-engineering and AI-augmented phishing, and architect defences accordingly.
- Clear incident response and communication strategy: The speed of response and clarity with customers, supply-chain partners and regulators materially influences reputational impact.
