David Dixon

Organisations are connected to more than ever before meaning supply chains have expanded and so too has the level of risk associated with these diverse supply chains.

Cloud services, managed service providers, SaaS platforms, open source software and outsourced business functions now form part of an extended digital supply chain that sits well beyond the traditional network perimeter. According to recent industry analysis by DeepStrike, third party involvement is now present in approximately 30% of all data breaches, double the proportion seen just a few years ago.

More concerning still, research from IBM shows that breaches involving supply chain compromise are typically more expensive and take longer to contain than other incidents. While the global average cost of a data breach currently sits at roughly $4.44 million, breaches via supply chains are uniquely more damaging. A supply chain compromise is one of the most significant factors that amplifies the total cost of a breach. In the UK it can cost an organisation an additional average of £241,620. (source: DeepStrike)

According To IBM’s Cost of a Data Breach Report 2025 it takes an average of 267 days to identify and contain a breach. As attackers increasingly exploit trusted relationships, instead of relying solely on technical vulnerabilities, supply-chain risk is now one of the most critical cyber security challenges for organisations of any size.

Supply chain cyber risk refers to the exposure an organisation faces as a result of its reliance on third‑party suppliers, vendors, partners, and software components. Rather than attacking a target directly, threat actors compromise a supplier and leverage the trust relationship to gain access to downstream victims.

Supply chain attacks have become an increasingly common and damaging tactic among cyber criminals. These breaches highlight just how vulnerable organisations can be when the security of their partners, vendors, and software providers is compromised.

Understanding supply chain risk begins with achieving full visibility across all third-party services and suppliers your organisation relies upon. Identifying these critical relationships is essential, as gaps in awareness can expose internal systems and sensitive data to external threats.

Assessing each supplier’s security maturity and posture helps clarify potential vulnerabilities, while evaluating how easily attackers might exploit these connections provides insight into your overall risk profile.

Importantly, your industry or sector also shapes the likelihood and nature of supply chain attacks. Certain fields, such as finance or healthcare, face heightened targeting due to the value of their assets and data. Proactive supply chain risk assessment empowers organisations to anticipate, mitigate, and respond to threats more effectively.

Data breaches are increasingly common, and news reports frequently highlight these incidents. Millions of email addresses and passwords have been stolen, sold, and shared across the Dark Web. But what exactly is the Dark Web, and what threat does it pose to organisations?

In this article we journey into the depths of this digital Wild West. Much like the lawless frontiers of the past, the Dark Web is a digital landscape where anonymity and illicit activities thrive beyond the reach of many authorities. We explore what the Dark Web is, its role in cyber crime, and recent reports on data leaks. In addition, we cover measures that organisations can take to prevent their most sensitive assets from ending up for sale on the Dark Web.

The Dark Web is a hidden part of the internet that operates outside the bounds of conventional search engines and requires specialised software, configurations, or authorisation for access.

While the Dark Web is home to many legitimate companies, it also contains message boards, online marketplaces for drugs, as well as stolen financial and private data. Transactions within this economy are often made with cryptocurrency and are completely anonymous.

The Dark Web is infamous for its role as a hub for illicit activities, providing anonymity to users engaged in cyber crime, data breaches, and other nefarious deeds. It facilitates a vast market for stolen data, compromised credentials, and hacked accounts. With corporate credit cards, criminals can cause financial damage and make unauthorised purchases. The risk is more than just financial damage from stolen credit cards, with employee details criminals can launch more sophisticated and targeted attacks. Phishing attacks are one of the most common attack methods employed by cyber criminals, and could be the entry point for further compromise to your organisation.

The Dark Web is not just stolen credentials, it also harbours platforms where individuals can hire hackers for various malicious purposes, from launching cyber attacks to conducting espionage. If you can imagine it, it’s probably out there on the Dark Web.

Recent reports from sources like CSO Online and the University of Surrey underscore the growing prevalence of cyber criminal activities on the Dark Web, posing significant threats to enterprises and individuals alike.

Recently, a wave of cyber-attacks has struck some of the UK’s most well-known retailers: Marks & Spencer, the Co-op, and Harrods. These incidents have disrupted services, forced systems offline, and cost millions in lost revenue. They are not just unfortunate timing. They are a wake-up call for not just the retail industry, but for every organisation across the UK.

The message is clear, if the “big guys” can fall victim, anyone can.

Easter Weekend (29–31 March 2025)

Marks & Spencer was the first to experience a major disruption. Over the bank holiday weekend, the retailer suffered a ransomware attack reportedly carried out by the group DragonForce. The incident forced M&S to take its website and apps offline, halting Click & Collect services and disrupting contactless payments and loyalty programmes.

With online sales accounting for approximately £3.8 million per day in its clothing and home division, the financial impact was immediate and substantial. M&S later confirmed that customer data had been stolen, although it clarified that the compromised information did not include passwords or payment details. [Source: BBC]

Wednesday 7 May 2025

The Co-op revealed that it had taken parts of its IT infrastructure offline in response to suspicious activity, as a precaution against a potential cyber attack. Staff were instructed to keep cameras on during remote meetings and to verify all attendees, a signal that the company feared a deeper network compromise. The full nature and scope of the attack have not been publicly confirmed. [Source: BBC News]

Thursday 8 May 2025

Harrods became the third major retailer to confirm an incident. The company reported attempted unauthorised access to its systems. In response, its IT team restricted internet access at its stores as a protective measure. While its flagship Knightsbridge location and online store remained open and functional, the company has not disclosed further technical details or the extent of the attempted breach. [Source: BBC]

Ongoing Disruption

Cyber attacks are often widely disruptive. Customers at M&S have been unable to shop online for over a month, and reports indicate that disruption could last until July. The disruption of this cyber attack is estimated to cost M&S over £300 million. [Source: BBC]

Retail businesses, especially large chains, have become increasingly attractive to cyber criminals.

• They manage large volumes of customer data, including payment information, delivery details and login credentials.
• Their operations are deeply digital, from logistics and inventory management to payment systems and loyalty apps.
• Any downtime causes immediate and visible disruption, creating pressure to resolve incidents quickly, sometimes under ransom demands.

At the recent Manchester Digital E-Commerce Conference, we conducted a live hack on a demo online store to show how quickly a compromise can occur.

Within minutes, our team exposed:

• A misconfigured ecommerce website that was vulnerable to exploitation.
• How an SQL Injection could steal usernames and encrypted passwords.
• How easily we decrypted the passwords due to weak passwords and poor encryption algorithm.
• Weak login process with no 2FA which enabled us to access all details on the account – including address and payment information.

Most successful attacks do not rely on sophisticated exploits and threat actors will almost always for the path of least resistance to establish a foothold. They rely on simple oversights, poor digital hygiene or human error.

Even today, the number one, most prevalent vulnerability facing applications globally are broken access controls according to the Open Worldwide Application Security Project (OWASP) [source: OWASP Top Ten]

While the recent attacks are concerning, they highlight areas where many organisations can make meaningful improvements. Addressing cyber risk doesn’t require a drastic overhaul or reacting with panic.

Instead, it begins with a focused review of your current cyber security posture. You should review the technologies you use, your internal processes, and your existing policies. The priority should be to identify gaps, understand where your most critical assets lie, and take measured, practical steps to reduce risk.

Some of the key steps you should consider are:

• Use Multi-Factor Authentication (MFA) across all admin and critical access points.
• Patch and update all systems regularly, especially third-party plugins and platforms. Utilising patch management software can make this process faster and easier.
• Use 24/7 log monitoring and alerting tools such as a Security Information and Events Management (SIEM) and Early Detection and Response (EDR) solutions across your applications and endpoints that can detect and record anomalous activity such as repeated attempted login failures in real time.
• Conduct regular security audits, penetration tests, and code reviews.
• Segment networks and use monitoring tools to detect abnormal behaviour early.
• Train staff on phishing, social engineering, and access protocols.
• Have an incident response plan in place and test it regularly.

The recent incidents at M&S, Co-op, and Harrods are not anomalies. They are signs of a threat landscape that is growing more aggressive and opportunistic. For any organisation operating online or relying on digital systems, the risk is very real.

At CyberLab, we help businesses strengthen their defences, uncover vulnerabilities before attackers do, and stay ahead of the threat curve.

As the festive season approaches, the excitement surrounding Black Friday, Cyber Monday, and Christmas shopping often leads to a sharp increase in cyber threats. During this time, online consumer behaviour changes drastically- shoppers are eager for deals, working against the clock, and spending more time online.

This frenzy presents an ideal opportunity for cyber criminals, who take advantage of increased online traffic, distracted users, and businesses operating out-of-hours to launch attacks. For organisations, this shift introduces unique risks and demands heightened security measures.

This month, we are focusing on the elevated cyber risks associated with the festive season. We will explore how cyber criminals exploit holiday shopping habits and changes in consumer behaviour, provide examples of high-profile incidents, and offer best practices that organisations can implement to safeguard their operations during this critical period.

During peak shopping times like Black Friday and Christmas, cyber crime rises as consumers spend billions online. A recent report by ThriveDX found that ransomware attacks increase by 30% during the holidays compared to regular months.

Cyber criminals know that consumers are often distracted while hunting for deals, leaving them vulnerable to phishing attacks and other scams. According to Forbes, in 2022 37% of data breaches in retail involved stolen payment card data, and ransomware accounted for 24% of breaches, with retailers often pressured to pay to avoid disruptions during their busiest sales periods.

A notable example of cyber criminals exploiting the festive period to steal payment card data is the Target breach, which affected approximately 40 million credit and debit card accounts during the holiday shopping period. The attack, facilitated by malware installed through an HVAC subcontractor, led to widespread customer distrust and hefty fines. This incident is a stark reminder that even well-established businesses with strong security frameworks can fall victim to cyber crime during the holidays.

Cyber security has become a critical issue for higher education (HE) institutions due to their unique structures. Academic institutions have open environments where many users access shared networks from various devices and locations.

This makes them prime targets for cyberattacks. Common threats include phishing attacks, ransomware, Distributed Denial of Service (DDoS) attacks, and data breaches. Plus, the rise of remote learning and cloud adoption has increased the potential attack surface for many educational institutions, making it harder to manage cyber security.

Higher education institutions are attractive targets for threat actors due to their decentralised structures, large user bases, and the diversity of data they store.

Universities, for example, often have open networks to support collaboration and research, creating vulnerabilities and exploitable gaps in infrastructure. They typically hold valuable intellectual property, cutting-edge research, financial data, and personal student/staff information. Additionally, a blend of staff, students, and external collaborators using a range of different devices further complicates security oversight and can make endpoint security management a living nightmare.

Considering all of these factors, Higher Education Institutions appeal to a wide spectrum of motives for threat actors to target them; nation-states may target them for espionage and to obtain valuable research data, while ransomware groups view them as lucrative opportunities due to their reliance on constant system availability for academic and administrative purposes.

In the past year alone, 97% of UK higher education institutions reported cyber incidents, spanning across a wide variety of attack vectors and methods, according to a recent survey by the NCSC.