2025 has been a reminder that cyber incidents are no longer edge cases or rare failures. They are part of the modern operating environment, affecting organisations of every size, sector, and geography.
From global retailers and manufacturers to government bodies and education providers, this year’s breaches show a clear pattern: attackers are faster, more targeted, and increasingly focused on operational disruption rather than just data theft.
Below are some of the most significant breaches of 2025 and the lessons they offer for organisations trying to stay resilient.
1. Marks & Spencer and UK retail disruption
Around £300m in lost profits
One of the most high-profile UK incidents of the year involved Marks & Spencer, where a cyberattack led to prolonged disruption of online ordering and internal systems. Other major retailers, including the Co-op and Harrods, also experienced attacks during the same period, highlighting a broader pattern across the retail sector.
While details varied, the impact was consistent: customer-facing services were interrupted, internal operations slowed, and trust was tested.
What we learned:
Retail environments are highly interconnected, which makes resilience just as important as prevention. When systems that support ordering, fulfilment, or payments go down, the damage is immediate and visible. Businesses need segmented systems, strong monitoring, and recovery plans that assume disruption will happen.
2. Jaguar Land Rover and supply chain exposure
5,000+ businesses affected, £1.9 billion loss to UK economy
As we covered earlier in the year, Jaguar Land Rover confirmed a significant cyber incident in 2025 that resulted in data theft and operational disruption across parts of its business. The attack affected internal systems and had knock-on effects for production and suppliers.
This was not simply a data breach. It was a demonstration of how cyber incidents can ripple through complex manufacturing ecosystems.
What we learned:
Modern organisations do not operate in isolation. Supply chains, partners, and third-party systems expand the attack surface. Security strategies must account for this interdependence, particularly in industries where downtime has immediate financial impact.
3. Romanian Water Authority ransomware attack
1,000+ systems disabled
A ransomware attack against the Romanian water management authority took more than a thousand systems offline across regional offices, disrupting core IT services. While water delivery continued, infrastructure and emergency IT response were severely tested. Tom’s Hardware
What we learned:
Critical infrastructure cannot treat cybersecurity as an afterthought. Reliable segmentation, offline backups, and tested continuity plans keep essential services running during disruptions.
4. UK Foreign Office cyber incident
Impact unclear
The UK’s Foreign, Commonwealth and Development Office confirmed it had suffered a cyber intrusion in 2025. While officials stated that sensitive data was largely protected, the incident reinforced the reality that even well-resourced government bodies are not immune.
The breach drew attention to the importance of detection and response, not just prevention.
What we learned:
Perimeter security alone is not enough. Organisations must assume that some level of intrusion will occur and focus on visibility, rapid detection, and containment to limit damage.
5. Aflac cyberattack
22 million people impacted
Insurance provider Aflac disclosed a substantial breach affecting 22.65 million individuals after threat actors accessed sensitive personal information, including SSNs, health records, and claims data. The attack was attributed to the Scattered Spider group, which has been heavily targeting the insurance industry in 2025.
What we learned:
Third-party relationships and industry sector trends matter. When threat groups focus on certain verticals, specialised defences (including secure CRM configurations and robust customer data protection) become critical.
6. Kido International Nursery Group breach
Personal data of over 8,000 children and their families accessed
One of the more troubling incidents of the year involved Kido International, a childcare provider operating across the UK and Europe. The attack led to the exposure of personal data belonging to children and parents, triggering serious safeguarding concerns.
This breach demonstrated how devastating cyber incidents can be when sensitive personal information is involved, particularly in education and care settings.
What we learned:
Any organisation handling sensitive personal data must treat security as a core responsibility, not an IT function. Data classification, access control, and monitoring are essential, especially when the data involves vulnerable individuals.
7. Coupang data breach
33 million customers affected
South Korean e-commerce giant Coupang disclosed a massive breach late in 2025 in which internal systems were accessed by a former employee, exposing personal information – including names, delivery addresses, and email addresses – of more than 33 million users. The incident triggered a U.S. securities class action lawsuit alleging failure to disclose the breach and inaccurate statements about its cybersecurity posture.
What we learned:
Echoing the attempted BBC login ransom back in October, insider threats are increasing and they matter at scale. Access controls, least privilege, timely offboarding, and monitoring for unusual internal activity are essential parts of a modern security strategy; as we learned from the BBC’s
8. University of Phoenix ransomware breach
3.5 million victims
In one of the largest U.S. education sector breaches of the year, University of Phoenix confirmed a Cl0p ransomware attack affecting nearly 3.5 million individuals after a zero-day vulnerability was exploited in Oracle’s E-Business Suite. The data exfiltrated included names, birth dates, SSNs, and banking details.
What we learned:
Enterprise software needs rapid patching and hardening. Technologies like identity protection, network segmentation, and timely vulnerability management reduce attack surface for ransomware actors.
Common takeaways from 2025 breaches
Across industries and attack types in 2025, several themes are clear:
Credential and access misuse remains a top attack vector. Whether through insider access or credential theft, controlling and monitoring accounts is essential.
Ransomware remains a significant disruptor. These incidents often combine encryption with data exfiltration, increasing stakes for recovery planning and offline backups.
Third-party and supply chain risk continues to widen attack surfaces. Organisations must assess not just their own security posture but that of key partners and service providers.
Infrastructure and public services are not immune. Cities and utilities like water authorities highlight the critical need for resilience and incident response planning.
Detection and response speed matter as much as prevention. The time it takes to identify and contain an incident directly impacts business continuity and recovery outcomes.
How to avoid being on the list in 2026
Each of these breaches shows that no organisation is too big, too small, or too secure to be targeted. Strong security today relies on:
- Zero trust and least-privilege access models
- Layered authentication and identity protection
- Offline, tested backups and rapid recovery playbooks
- Third-party risk assessment and supply chain security
- Continuous monitoring and incident response readiness
Learning from real, high-impact incidents helps you prioritise security measures that matter most.
Dr Logic works with organisations that want clarity, not fear. We help you understand where your real risks are, how resilient your systems actually are, and what practical steps will reduce exposure without disrupting how your teams work.
If you want an honest view of your security posture, or you are unsure how well your current setup would hold up under pressure, we can help you assess it calmly and methodically.
Talk to Dr Logic about strengthening your security before it becomes urgent.
