The True Cost of a Cyber Incident
Security Lessons from M&S, Co-op, and Jaguar Land Rover
In this Blog
The High Price of Disruption: Recent UK Case Studies
Jaguar Land Rover: The Most Expensive Cyber Attack in UK History
In late August, Jaguar Land Rover (JLR) suffered a crippling cyber attack that forced a month-long shutdown of its internal systems and production lines. The estimated cost? At least £1.9 billion ($2.5 billion), making it the most economically damaging cyber event ever recorded in the UK.
The attack halted production at multiple sites, affected over 5,000 organisations in the supply chain, and required a £1.5 billion government loan guarantee to stabilise operations.
JLR’s wholesale deliveries dropped nearly 25% year-on-year, and the full recovery is not expected until early 2026. Analysts estimate JLR was losing around £50 million per week during the shutdown. (source: BBC)
Marks & Spencer and Co-op: Retailers Under Siege
Earlier this year, Marks & Spencer (M&S) and Co-op were hit by cyber-attacks that, while less costly than JLR’s, still resulted in staggering losses. The M&S breach, which shut down online services for two months, is estimated to have cost the retailer £300 million. (source: Sky News)
The attack exploited social engineering tactics, manipulating IT helpdesk staff into resetting passwords and bypassing security controls. Co-op and Harrods also suffered significant incidents, with the combined financial impact of the retail sector attacks estimated between £270 million and £440 million. (source: msn.com)
Why Are the Costs So High?
Operational Downtime: For JLR, every day of halted production meant lost vehicle sales, supply chain disruption, and financial strain on thousands of partner businesses.
Supply Chain Ripple Effects: The JLR attack affected over 5,000 organisations, with some suppliers facing collapse due to delayed or cancelled orders.
Reputational Damage: Retailers like M&S faced public scrutiny, parliamentary investigations, and the need to sever long-standing IT partnerships in the wake of the breach.
Regulatory and Legal Costs: UK GDPR and Data Protection Act violations can result in fines up to £17.6 million or 4% of global turnover, not to mention the cost of remediation and customer notification.
Lessons Learned: What These Incidents Teach Us
Cyber Security is Economic Security
As highlighted by the National Cyber Security Centre (NCSC), the scale of these incidents means that cyber resilience is now a matter of national economic security, not just IT hygiene. With 4 major incidents being reported per day in the UK, and a 50% increase from last year in ‘nationally significant’ attacks, UK businesses that fail to prepare for such events risk putting serious strain on the nation’s economy and increase our collective exposure to such events. (source: NCSC)
When discussing the new UK Cyber Resilience Bill, Gavin Wood, CyberLab CEO stated:
Improving cyber resilience is a shared responsibility. Government, businesses, and service providers each have a role to play.
Attackers Exploit the Basics
Many breaches still begin with social engineering, weak access controls, or poor digital hygiene. This serves as a reminder that foundational security practices remain critical.
Preparation and Response Matter
The ability to rapidly detect, contain, and recover from incidents can dramatically reduce costs. Incident response retainers and robust playbooks are essential investments.
Get Your Cyber Essentials Certification
Show you’re serious about cyber security and prevent security incidents by achieving Cyber Essentials with CyberLab.
As an IASME approved assessor for the Cyber Essentials and Cyber Essentials Plus, we offer a range of options depending on your requirements and technical ability.
Best Practices for Mitigating the Cost of a Breach
No organisation is immune to cyber incidents or data breaches. Experiencing one is a matter of when, not if. While absolute, around-the-clock security appears unattainable in a constantly evolving threat landscape, adopting proven best practices can make a significant difference. By implementing these steps below businesses and organisations can greatly reduce the impact and financial burden of inevitable cyber events:
Invest in Resilience
Regularly review and test incident response plans. Ensure board-level oversight of cyber risk.
Implement Multi-Factor Authentication (MFA)
Require MFA or two-factor authentication (2FA) for all users, especially for accessing sensitive systems, to provide a crucial layer of security beyond the password.
Supply Chain Security
Assess and support the cyber resilience of key suppliers. Proactively manage your third-party risk, monitor vendor posture, and strengthen your supply chain security with HackRisk’s Supply Chain Security tools.
Cyber Insurance
While insurance can offset some costs, most policies only cover a portion of total losses. Understand your coverage and its limitations.
Continuous Dark Web Monitoring
Employ tools or services such as HackRisk AI to monitor for compromised credentials on the dark web, allowing for swift response if employee or organisational data is found in breach dumps.
Comprehensive Staff Training
Deliver regular cyber security awareness training for all employees, with a focus on recognising phishing attempts, the importance of password hygiene, and how to respond to suspicious activity.
Ongoing Policy Review and Enforcement
Routinely review and update password and authentication policies to adapt to emerging threats and ensure enforcement with automated checks wherever possible.
Final Thoughts: Reducing Risk
The financial consequences of a cyber incident can be devastating and, in some cases, fatal for organisations, as demonstrated by the experiences of companies such as JLR, M&S, and Co-op. These cases underscore how quickly costs can escalate, cascading far beyond initial estimates and affecting multiple facets of a business.
Given the severity of potential losses, it is essential for organisations to recognise cyber security as an integral business risk in order to preserve not just brand and reputation but ultimately business survival.
Treating cyber security with the same level of attention as other core business risks ensures that appropriate resources are allocated to mitigation and preparedness, potentially reducing the harm caused by cyber incidents and also the penalties or fines that may be imposed.
Get Your Free HackRisk Report
AI-powered cyber risk monitoring with secure dashboard and shareable reports, delivered by security experts.
We’ll perform a full external scan and generate your first HackRisk Report, completely free of charge.
You will receive your HackRisk report within 24 hours. No card details necessary.
Leave a Reply
You must be logged in to post a comment.