Cyberattacks in 2025: What can organisations do to stay protected?

There has been major turbulence in the world of cybersecurity in the first few months of 2025, with a surge in ransomware attacks and cyber threats rocking key sectors, both in the UK and internationally. Multiple high-profile organizations, from retail and healthcare to public education and government institutions, have been hit by significant data breaches and cyber-related incidents. 

This blog will summarise the key incidents that unfolded in 2025 to date, analyse their implications, and provide information on regulatory responses, as well as recommendations for organisations aiming to strengthen their cyber defences. 

Key cyberattack incidents in 2025

Retail 

M&S - A cyberattack occurred on 17 April 2025 involving the British retailer Marks & Spencer, during which fundamental retail operations such as contactless payments and online ordering were compromised. The breach has already caused reputational damage and financial losses of millions of pounds. 

The Co-op - Shortly after the M&S attack, the Co-operative Group was forced to shut down parts of its IT infrastructure, in response to an attempted cyberattack, which disrupted Co-op’s stock monitoring and access to internal systems. Furthermore, the Co-op has confirmed that the recent cyberattack led to the unauthorized access of a significant number of customer data, including names and contact details, relating to current and past members. While the Co-op has not publicly disclosed specific financial losses directly attributed to the recent cyberattack, the incident has had a notable operational impact including temporary store closures and supply chain interruptions, particularly in remote areas such as the Isle of Skye and Western Isles. 

Harrods – Just days after M&S and the Co-op were targeted, Harrods was also hit by a cyberattack. Harrods is understood to have been forced to shut down some systems and restrict internet access, however, all stores remained open, and it continued to operate its online sales. Harrods has not yet provided specific details regarding the extent of the breach or confirmed whether personal data was compromised.  

Healthcare 

HCRG Care Group - In February 2025, the HCRG Care Group (a UK healthcare provider formerly known as Virgin Care) was targeted in a significant cyberattack. The attackers (Medusa gang) claimed to have exfiltrated over 2 terabytes of data, including medical information. The hackers demanded a $2 million ransom.  

Frederick Health Medical Group - In January 2025, in the US, the Frederick Health Medical Group suffered a breach affecting almost 1 million individuals. Compromised data included names, addresses, Social Security numbers and medical records. Furthermore, in April 2025, DaVita Clinics, one of the largest dialysis providers in the U.S, faced encryption of critical parts of its network, by a ransomware group, disrupting internal communications. 

Education 

City of Edinburgh Council - In May 2025, the City of Edinburgh Council’s education systems was struck by a phishing-driven cyberattack, which exposed the public education infrastructure vulnerabilities and raised concerns regarding the preparedness of schools and councils to handle such digital threats. The attack led to a reset of all network passwords across schools, leaving over 2,500 students without access to key platforms, such as OneNote and Microsoft Teams, during their exam preparations.  

Baltimore City Public Schools - As reported by CBS News, Baltimore City Public Schools in the United States also suffered a breach that disrupted IT services and exposed sensitive data of some current and former employees, volunteers, contractors, and students. 

Council and Police

UK council and police websites - The pro-Russian group NoName057(16) attacked UK council and police websites in retaliation for British support of Ukraine, successfully overwhelming public-facing servers and causing temporary service disruptions. These distributed denial-of-service (DDoS) attacks, while not data breaches, caused temporary public service outages and they are emergent tactics in cyberwarfare to erode public trust. 

Rising Threat Landscape

According to UK’s National Cyber Security Centre’s (NCSC) annual review report, cyber threat is dynamic and grows more complex each year. The rise is partly attributed to Cybercriminals adapting their business models to embrace the use of AI to increase the volume and impact of cyberattacks, and exploit vulnerabilities related to AI. In line with this report: 

• Over 1950 cyberattacks occurred in 2024. 
• 89 were considered significant, and 12 highly severe – a three-fold increase year-over-year. 

The NCSC has also recently reported the doubling of nationally significant cyber incidents between September 2024 and May 2025. 

Regulatory and Legislative Response

As cyberattacks increase in complexity and frequency, the regulators are responding with updated policies and legislative initiatives, such as: 

• The Cyber Security and Resilience Bill (UK): Announced in April 2025, this bill aims to improve UK cyber defences and protect its essential public services, by creating stricter requirements for response, risk assessment, and reporting. 
• Data (Use and Access) Bill: Currently under review, this legislation seeks to improve cross-sector data-sharing while maintaining strict privacy safeguards. 
• The EU Cyber Resilience Act (CRA): Introduces a uniform framework of mandatory cybersecurity requirements for products with digital elements. 
• The EU-wide NIS2 legislation: imposes new obligations on providers of critical infrastructure, defined in the act as ‘Important Entities’ or ‘Essential Entities’.

How Organisations Can Protect Themselves

Every organisation must adopt a robust cybersecurity posture, particularly given the frequency of attacks and the variety of sectors impacted and methods of attack. Below are some essential measures which can help reduce risk and improve response readiness: 

• Prioritise Endpoint Security by ensuring that all devices and servers are protected with advanced endpoint security solutions. 
• Patch and Update regularly. Ensure systems and software are patched as soon as updates become available, by using automated tools. 
• Implement Zero Trust Architecture. Ensure that all users and devices must authenticate themselves before accessing network resources. 
• Enforce Multi-Factor Authentication (MFA) across all user accounts. 
• Implement Real-Time Monitoring to monitor and respond to suspicious behaviour instantly. 
• Maintain encrypted, offline backups. 
• Train your staff, as human error remains a leading cause of breaches. 
• Align With Regulatory Standards and ensure that your practices are legally compliant and auditable. 
• Engage professionals to conduct Third-Party Audits. 
• Have a robust incident response plan in place. 

As data becomes increasingly valuable, cybercriminals continue to advance their tactics, targeting both human error and technical vulnerabilities. From exam disruptions in schools to paralyzed supply chains in retail, the cybersecurity threats of 2025 are more integrated into daily life than ever before. By proactively investing in technology, training, and compliance, organisations can reduce their risk and maintain the trust of their customers and stakeholders. 

Trilateral’s Data Protection and Cyber Risk Team have cybersecurity and data protection specialists with extensive expertise and experience in assisting organisations in building robust frameworks, policies, procedures and training to ensure prevention of cybersecurity threats.

If you’d like to know more about how our cybersecurity experts can support your organisation, check out the specialist services we provide. Please feel free to contact our advisors who would be more than happy to help.