The recent ransomware attacks on M&S and other British retailers serve as a reminder – as if we needed one – of the ubiquitous nature of cyber crime, and the widespread disruption which it can cause to both businesses and individuals.

The BBC has reported that M&S began experiencing problems over the Easter weekend (the risk of cyber attack increases during public holidays) and that some of its operations, including online food ordering, remain offline some two weeks later.

The UK’s data regulator, the Information Commissioner’s Office, has confirmed that it is “making enquiries” with M&S, as well as the Co-op Group, which was also subject to recent attack. The ICO will be looking to establish whether the security measures employed by M&S and the Co-op were appropriate, or whether they contributed to the success of the attacks. If either entity is held to have breached its obligations under the UK GDPR, formal enforcement action may follow. 

Following these incidents, the National Cyber Security Centre has published further recommendations for businesses on the steps they can take to improve their security position.

In addition to the impact on the companies targeted by the attack, individuals may also be affected where their personal data was exfiltrated by the attackers. As well as the loss of privacy, this can expose individuals to increased risk of identity theft or fraud.

These recent incidents reflect a number of the key themes and issues which we cover in our regular cyber blogs, which are available here:

Burness Paull’s leading cyber security, data protection and group litigation experts have significant experience in managing cyber security risks, including ransomware attacks, and best practices. Our team are on hand to support you on your cyber resilience journey, from implementing protective measures to handling a full-scale incident. Please get in touch with any of our team to discuss your needs.

Written by

Related News, Insights & Events

Error.

No results.

Risk Resilience 3 (1)

Risk resilience: Navigating the storm

29/10/2025


Technology, regulatory changes, changing market forces, and macroeconomic factors all present key concerns for business.

Read more
Regulatory Changes Football

Regulatory changes afoot for UK football clubs

30/09/2025

This blog explores a number of regulatory changes occurring in the UK football sector.

Read more
Arbitration Appeal In Dilapidations Case (Schedules Of Condition) (002)

Arbitration appeal in dilapidations case (schedules of condition)

26/09/2025

What the latest in a string of decisions refusing leave to appeal an arbitration decision means for lease disputes.

Read more

Want to hear more from us?

Subscribe here Subscribe here