The cyber attacks in the news have been aimed at Marks & Spencer, the Co-op and Harrods, but this is not just a issue for retailers. Hackers can strike almost any firm, in any line of business, at any time and anywhere in the world.
The terrifying truth for business leaders – and for investors – is that the risk is practically universal. FTSE 100 bosses and entrepreneurs running small firms are living in fear they could be next.
Cyber attacks have cost UK companies £44 billion in lost revenue over the past five years and have affected 52 per cent of firms, says insurance broker Howden.
Some have called in former hostage negotiators, skilled in dealing with blackmailers and terrorists. Others have claimed on their insurance policies to pay ransom demands, fuelling concerns that the very existence of such cover encourages the criminal gangs.
Typically, they find a way in through chinks in a company’s cyber armour, such as the IT systems of a supplier. A hacking gang known as DragonForce claimed responsibility for the attacks on M&S, Co-op and Harrods. Some experts said they bore the hallmarks of a group of teenage blackmailers under the name of Scattered Spider. Whichever criminals were involved, they launched the devastating assault over the Easter bank holiday.
Top brass at M&S will be highly reluctant to pay a ransom, as and when a demand is made. Typically, this happens via the dark web and hackers demand payment in cryptocurrency.
Under attack: Hackers can strike almost any firm, in any line of business, at any time and anywhere in the world
Experts say the retailer’s case, now in its third week, is a classic ‘ransomware’ attack, where data systems are infiltrated, disabled and only unfrozen when a ransom is paid.
The damage done to M&S is there for all to see. Shelves have been emptied. Customers have been unable to place orders via its website and app, warehouse staff have been sent home and the retailer’s popular click-and-collect service remains suspended, though contactless payments in store have been restored. Even recruitment has been paused as fears grow that the cyber crisis could take months to resolve.
There are concerns that working from home could be a risk factor. According to M&S’s latest annual report: ‘The sophistication and frequency of cyber-attacks continue to increase’ as the company operates ‘a hybrid work model’.
Outsourcing IT by using contractors is also an issue. M&S adds: ‘Our reliance on key third parties for selected services and/or hosting of data also exposes us to risks from vulnerabilities in their cyber and data controls.’
The Co-op admitted on Friday that hackers had been able to access a ‘significant number’ of its customers’ personal data, including names and addresses but not passwords or financial information such as credit card details of its 6.2million members.
In November last year Co-op’s rival Morrisons was hit by hackers who targeted its warehouse technology supplier Blue Yonder. The NHS, the Guardian newspaper and the British Library have also been subject to ransomware attacks – causing serious short-term disruption to their systems.
In some cases, the damage is fatal. Foreign exchange firm Travelex collapsed six months after a ransomware attack at the end of 2019. Administrators cited the incident as a key factor.
‘It’s a threat to all of us,’ said George Weston, chairman of Primark owner Associated British Foods. Cyber crime is ‘a risk you’re never fully on top of, no matter how hard you work at it’.
His views are echoed by Barclays chief executive CS Venkatakrishnan, who said the bank spent ‘a lot of time, attention and money on’ cyber security. He added: ‘This I think is for the foreseeable future close to the top of any business leader’s list of things to worry about and spend time on.’
Of the M&S attack he said: ‘We always try to stay one step ahead but, as this incident seems to indicate, it is a very dangerous world out there so we do our best to protect ourselves, learn from others.’
At Lloyds, finance chief William Chalmers said the bank had invested hundreds of millions of pounds in cyber security.
The scale of the threat to businesses across the board was laid bare in a recent Government report, which said: ‘For the serious and organised crime gangs behind the global fraud industry, ransomware is an increasingly lucrative part of their operations.’
Sleepless nights: M&S shoppers are unable to buy items online, such as pyjamas modelled by Rosie Huntington-Whiteley
Ransomware attacks on UK firms ‘significantly increased between 2024 and 2025’, the report added, with an estimated 19,000 companies falling victim to a ransomware attack over the period. The National Cyber Security Centre reckons 76 per cent of UK businesses experienced a cyber security incident in the past year.
Most were from lower-level ‘phishing’ attacks, where fake emails or websites are used to gain access to a user’s password or credit card details to harvest cash.
Smaller firms are not immune and can be seen as a softer touch.
One key question is whether companies are employing enough board directors with expertise in this field. Most chairmen and chief executives are in their 50s or above – decades older than the teenage hackers of Scattered Spider who grew up online. If anything, boardrooms seem to have grown weaker in this respect.
In 2021, nearly 40 per cent of company boards had a director with specific responsibility for cyber security. This has fallen sharply to just over a quarter.
That, says Oli Buckley, professor in cybersecurity at Loughborough University, is unsatisfactory.
‘Ultimately the buck stops with the chief executive and the board,’ he added. ‘Boards don’t need to become experts in the technical minutiae such as firewalls or encryption, but they do need to be actively engaged, ask the right questions, and ensure the right structures are in place.’ The cost of ransomware attacks has led to the growth of cyber insurance. Policies generally cover business interruption losses incurred during an attack and the cost of restoring IT systems afterwards.
They also pay ransom-related costs, such as negotiation or legal advice, and even the payment itself – up to a set limit.
‘Most of our members offer cover where they will reimburse the payment of a ransomware demand,’ said Chris Mather, an underwriter at the Lloyd’s Market Association.
‘Ransomware claims make up a big chunk of overall cyber claims. It’s a very popular cover.’ But payouts are only made after sanctions and financial crime checks have been carried out.
‘Payments can’t be reimbursed that have been made to prescribed individuals or entities such as terrorists,’ said Mather.
It is unclear how many companies pay up to stop a cyber attack.
Only half of businesses have a rule or policy not to pay ransomware demands. ‘Cyber insurance is not a silver bullet,’ Prof Buckley said. ‘Insurers require organisations to demonstrate strong cybersecurity controls before offering comprehensive cover, in the same way your contents insurance depends on you having locks on the doors.’
For investors, cyber-security is a key issue, given the damage it can do to share prices.
M&S shares, which had been rising strongly, have been hit. The price has fallen more than 8 per cent, wiping £700 million off the company’s stock market value (see chart).
Susannah Streeter at investment platform Hargreaves Lansdown said: ‘It’s a wake-up call for organisations to ensure their IT systems have fortress-like security given the determination of hackers to cause widespread disruption, and both financial and reputational damage.’
The problem is that, however hard a business tries to secure its systems, it has to be watertight all of the time, whereas the hackers need only be lucky once.
Additional reporting by Emily Hawkins, John-Paul Ford Rojas and Richard Marsden
DIY INVESTING PLATFORMS
AJ Bell
AJ Bell
Easy investing and ready-made portfolios
Hargreaves Lansdown
Hargreaves Lansdown
Free fund dealing and investment ideas
interactive investor
interactive investor
Flat-fee investing from £4.99 per month
InvestEngine
InvestEngine
Account and trading fee-free ETF investing
Trading 212
Trading 212
Free share dealing and no account fee
Affiliate links: If you take out a product This is Money may earn a commission. These deals are chosen by our editorial team, as we think they are worth highlighting. This does not affect our editorial independence.
This article was originally published by a www.dailymail.co.uk . Read the Original article here. .