In April 2025 a cyber attack paralysed Marks & Spencer, costing the FTSE 100 retailer £131mn and exposing a new breed of attacker: the English‑speaking collective Scattered Spider, whose members are teenagers and young adults motivated by reputation as much as profit. Similar incidents hit Transport for London, Harrods and the Co‑Op, prompting a wave of high‑profile arrests. Owen Flowers and Thalha Jubair, two British men already known to police, were sentenced to five years and six months for the 2024 TfL breach that cost up to £39mn.

The surge in activity has expanded the ransomware landscape: S‑RM recorded 67 distinct ransomware groups in 2025, up from 58 a year earlier, making outcomes harder to predict. Yet experts such as Rafe Pilling of Sophos stress that Russian‑speaking groups still dominate the most prolific ransomware rankings, while AI tools are lowering entry barriers — 76% of organisations reported AI‑related security incidents in the past two years, according to Kroll.

In response, the NCSC and senior ministers, including Chancellor Rachel Reeves and Business Secretary Peter Kyle, have urged CEOs to rehearse business‑continuity plans, warning that failure to prepare jeopardises the future of their firms.