Cyber Attacks Threaten British Businesses

A survey has found that British businesses fear hackers could wipe them out following the devastating cyberattack on Marks & Spencer.

Two-thirds of security leaders at medium and large-sized companies in the UK admit an attack on a similar scale could ‘cripple’ their organisation.

Experts have warned that the financial damage from ransom demands and clean-up costs can often cost millions of pounds—enough to jeopardise some firms’ futures.

The poll by Absolute Security was carried out just weeks after M&S was hit over the Easter holidays, costing the retailer £300 million and shaving £1 billion off its market value.

M&S boss Stuart Machin recently admitted the attack – caused by ‘human error’ – had been ‘the most challenging situation we’ve encountered’.

Security leaders further revealed staff still working from home remained a major problem, with 62 percent revealing remote devices were the ‘biggest weakness’ in their digital defences.

Over half – 51 percent – of the businesses polled had been hit by a ransomware attack in the past year, with 59 percent citing it as their biggest concern.

The consequences of such an attack are profound, with 63 percent of the 250 security leaders polled in May revealing the financial loss from ransomware could incapacitate their organisation.

The average cost of a ransomware attack on businesses is £850,000 in the UK – but this can increase exponentially for bigger firms.

The LockBit group demanded £65 million after hacking the Royal Mail in 2024.

The recovery costs from a cyberattack last year on Synnovis, a pathology services provider for the NHS that led to the cancellation and delay of thousands of medical procedures, were estimated at £32 million – over seven times the company’s annual profits.

Several UK firms have already gone bust following cyberattacks.

In 2020, Peterborough-based Travelex went into administration after being hit by a cyber attack by the notorious criminal gang REvil – who demanded a £4.6 million ransom – on New Year’s Eve.

A month of interruption resulted from the hack, which affected high-profile companies including Barclays and Asda and prevented employees from using computers to monitor trade.

The company said it ‘had a large part to play’ in the company filing for insolvency later that year, with 1,300 employees losing their jobs.

KNP Logistics – one of the UK’s biggest privately owned logistics groups – suffered a similar fate after a huge ransomware attack in June 2023. Three months later, it blamed the cyberattack when it declared bankruptcy, making 730 staff redundant.

Over the past month, major UK retailers – including M&S, Co-op, and Harrods – were struck by a surge of coordinated cyberattacks attributed to a hacker group known as Scattered Spider.

The attacks mostly used so-called ‘social engineering’ tactics, in which criminals manipulate workers into sharing sensitive information to get them into internal IT systems.

As a consequence, one of the greatest challenges remains the threat posed by staff working from home, with critics arguing workers refusing to come into the office frequently fail to install up-to-date security on their laptops for weeks or even months.

The survey showed that 60 percent of security leaders believe remote working has ‘complicated’ their capacity to safeguard against cyberattacks.

Jake Moore, global security advisor at cybersecurity software company ESET, said: ‘It’s not surprising that the majority of medium and large businesses would see their future thrown into doubt after a cyberattack.

‘Ransom demands are often in the millions, but even when the ransom isn’t paid, the costs associated with recovery and lost revenue can be staggering.

‘In some cases, such as with M&S, the clean-up operation can even cost far more than the original ransom payment forcing an unbelievably difficult decision at the time of attack.’

Andy Ward, SVP at Absolute Security, said: ‘Recent high-profile cyber attacks have highlighted just how vulnerable major British retailers—and indeed many UK businesses—have become. Cybercriminals now have the capacity to severely disrupt, or even dismantle, organisations at scale.

‘Our research reveals that many large and medium-sized UK businesses believe that a serious cyber incident could cripple their operations or threaten their very survival.’

The issue is that all of these businesses are outsourcing their IT to India and other countries because they believe they are saving money.

I’m not an IT person, although I know a little bit, and I would have to say employees working from home using a box standard router without extra security are putting our data at risk.

Working from home should be abolished. For centuries people have been going to the workplace to work, but then COVID raised its hideous crown and people started to work from home, and people started to become slothful, but times have changed and working from home is the future for numerous people.

These firms can’t have their cake and eat it. If they want huge cost savings then they should make significant investments in cyber security, not the bare minimum amount as possible, putting their customer’s security at risk. With the proper systems, and they’re not cheap but at least they would make cyber attacks a lot less likely.

To prevent hackers from simply stealing people’s data, individuals who work from home need protection on their computers. Since everyone with critical information should be at the office, it’s time to put an end to this craziness. Working from home is no longer necessary.

Since COVID, things have changed. Previously, working five days a week was the standard, but that is no longer the case. Some might argue that because things have changed, some people get left behind when they don’t embrace them.