The National Cyber Security Centre (NCSC) has reported a 50% increase in 'highly significant' cyber-attacks over the past year, with the UK now facing a nationally significant incident more than every other day. The figures, released in the NCSC's annual review, highlight a growing threat landscape driven by ransomware and society's increasing dependence on technology.
Ransomware attacks, often perpetrated by criminal actors seeking financial gain, are a key driver of the surge. The NCSC noted that hostile cyber-activity has become 'more intense, frequent and sophisticated', prompting a call to arms for organisations of all sizes to prepare contingency plans for potential IT infrastructure breakdowns.
In a joint letter to hundreds of the UK's largest companies, Chancellor Rachel Reeves, Security Minister Dan Jarvis, and other ministers urged businesses to make cyber-resilience a board-level responsibility. GCHQ Director Anne Keast-Butler emphasised: 'Don't be an easy target. Prioritise cyber risk management, embed it into your governance and lead from the top.'
The NCSC dealt with 429 cyber incidents in the year to September, nearly half classed as of national significance – more than double the previous year. Of these, 18 were 'highly significant', including attacks that severely impacted Marks & Spencer and the Co-op Group. A separate attack on Jaguar Land Rover, which halted manufacturing, is under investigation, with reports of possible Russian involvement.
State threats identified include 'highly sophisticated' China, 'capable and irresponsible' Russia, as well as Iran and North Korea. The NCSC also warned of Russian-linked 'hacktivists' targeting the UK, US, European and NATO countries. Over the past year, the UK and allies uncovered a Russian military unit conducting cyber-attacks, issued advice against a China-linked campaign, and raised alarms over Iranian cyber-actors.
Hackers are increasingly using artificial intelligence (AI), though the NCSC has yet to face an AI-generated attack. It stated: 'AI will almost certainly pose cyber-resilience challenges to 2027 and beyond.' NCSC Chief Executive Richard Horne stressed the emotional toll on victims: 'I've sat in too many rooms with individuals deeply affected by cyber-attacks... the worry, the sleepless nights.'
