The hidden cyber war: underreported attacks and rising risks in the UK

At Methods, I see daily that cyber security is no longer just an IT challenge; it's a fundamental business imperative. As we move into H2, cyber threats continue their relentless ascent, demanding heightened vigilance and proactive strategies from every UK organisation.

Recent events, like the DragonForce cyber attack on M&S, underscore real threats. More concerning, M&S Chairman Archie Norman revealed to Parliament's Business & Trade Committee (July 8, 2025) that two other major cyber attacks on large British companies went unreported in the last four months.

Norman noted that "quite a large number" of serious attacks never reach NCSC, highlighting a "big deficit" in our collective knowledge and transparency. 

The current reality (2025 insights):

• Persistent and underreported attacks: The Cyber Security Breaches Survey (2025) shows 43% of UK businesses and 30% of charities experienced a breach in the last 12 months. Phishing (85% of impacts) remains top. Unreported incidents mean the true scale is likely far larger. Yes, these threat actors are working overtime – perhaps a little too efficiently, wouldn't you say?
• Rising costs: average disruptive breach cost for businesses continues to rise!
• AI's double edge: AI empowers both sides. Experts see sophisticated AI impersonation becoming mainstream, making scams harder to spot and stressing the need for advanced detection.
• Supply chain vulnerabilities: only 14% of businesses review risks from immediate suppliers. This huge blind spot demands a holistic approach to third-party risk.
• The human factor: despite tech, human error remains a leading cause of successful attacks.
• Evolving regulations and transparency gap: the Cyber Security and Resilience Bill (H2 2025) expands scope, imposing stricter compliance, supply chain security. This focus on transparency is vital, especially given current underreporting and the "deficit in knowledge" on attack prevalence.

• Strategically assess and adapt: review defences, integrate cyber into core business strategy.
• Educate and empower: equip your workforce to be your strongest defence.
• Collaborate and partner: engage with peers, NCSC, and trusted advisors to share intel and build resilience.