Lessons from M&S and Jaguar Land Rover In recent months, the UK has faced a surge in high-profile cyberattacks, most notably targeting Marks & Spencer (M&S) and Jaguar Land Rover (JLR). These incidents have exposed critical vulnerabilities within both private industry and national infrastructure, raising urgent questions about the country’s cyber resilience. The attack on M&S over Easter 2025 was described as “highly sophisticated,” disrupting online orders, deliveries, and payment systems. Although no customer payment data was compromised, operational and financial losses were significant, reportedly nearing £300 million. Around the same time, JLR was forced to halt production across its UK factories following a cyber incident that caused weeks of disruption. The company’s lack of cyber insurance compounded the financial impact, with estimated losses exceeding £50 million per week.
These events highlight the growing threat of supply chain attacks, where hackers exploit third-party vulnerabilities to infiltrate larger targets, a risk affecting organisations of every size and sector. Government Response In response, the UK government has introduced a series of initiatives aimed at strengthening national cybersecurity.
Cyber Security Strategy 2022–2030 sets out long-term goals for securing public systems and promoting a cyber-aware culture. The proposed Cyber Security and Resilience Bill seeks to tighten reporting requirements, enhance supply chain oversight, and increase accountability for critical service providers. Following recent incidents, a £16 million funding package was announced to boost cyber resilience, including the creation of AI-focused security labs and tools to help businesses assess their vulnerabilities.
The National Cyber Security Centre (NCSC) has also launched training and guidance to support better preparedness and response across industries.
Cybersecurity specialists welcome these measures but stress that prevention, readiness, and supply chain resilience remain major gaps. Many organisations still lack visibility into their suppliers, leaving them exposed to indirect attacks. Experts recommend embedding cybersecurity standards into contracts, conducting regular audits, and ensuring all partners meet minimum compliance requirements. Human error continues to be one of the leading causes of breaches. Building a culture of security, supported by training, leadership engagement, and clear response plans is essential to reducing risk. Meanwhile, the low uptake of cyber insurance across UK businesses remains a serious concern, particularly given the scale of financial losses seen in recent incidents.
The road ahead, despite progress, the UK’s cybersecurity landscape still faces significant challenges: uneven enforcement of regulations, limited visibility across supply chains, and a persistent shortage of skilled professionals. The attacks on M&S and JLR serve as a stark reminder that cybersecurity is no longer just an IT issue, it is a national economic and security priority.
The next step for both government and industry is clear: move from reactive defence to proactive resilience before the next major breach strikes.
