Here's your digest of each month's biggest cyber security incidents and trends so far this year.
Pro tip: Review vendor security, patch rapidly, and update your incident response procedures.
February 2026
- Transport for London (TfL): Cyber disruption to passenger information systems leads to temporary service confusion, raising questions about the resilience of public infrastructure.
- UK Financial Services Firm: Sensitive trader communications exposed after a compromised collaboration platform token grants unauthorised external access.
- Insurance Regulator: Releases new draft guidance on cyber assurance following a sharp rise in data breach notifications during Q1 across small and mid-sized brokers.
Trend: Digital convenience continues to outpace digital security, with compromised integrations creating unexpected risk paths.
Takeaway: Treat every connected tool as a potential attack surface, and ensure cyber due diligence forms part of every technology adoption strategy.
January 2026
- Metro Health Trust: Patient record systems experience a multi-day outage linked to a ransomware variant previously seen in Europe, underscoring continued targeting of critical services.
- Global Payroll Provider: Data breach affects UK clients after a new year system update exposed credentials through an unpatched API endpoint.
- NCSC Special Report: The agency highlights ongoing attacks tied to state-backed groups exploiting widely used open-source tools, urging organisations to strengthen monitoring of developer environments.
Trend: Healthcare and HR platforms remain prime targets as attackers shift tactics from mass disruption to data monetisation.
Takeaway: Protect trust-critical systems with layered backups and continuous monitoring, not just reactive recovery plans.
December 2025
- British Airways: Reports surface of delayed flight operations after internal scheduling systems are temporarily taken offline due to a suspected phishing compromise. Customer communication services also affected during the disruption.
- UK Retail Network: A coordinated card-skimming campaign targets several high-street retailers during the holiday shopping surge, exploiting point-of-sale software vulnerabilities.
- Government Digital Service (GDS): Issues a year-end reminder urging all public sector bodies to review cloud security configurations after multiple misconfigured storage instances exposed confidential documents.
Trend: Criminal groups timed attacks around busy periods, exploiting operational pressure and seasonal spending spikes.
Takeaway: Build resilience into peak operations—train staff to spot social engineering, and ensure payment systems are regularly audited and patched.
November 2025
- Royal Mail: Systems disruption following a suspected ransomware incident delays parcel tracking and international shipments. Investigation underway into potential data exfiltration.
- University of Manchester: New findings confirm that the 2024 cyberattack led to exposure of sensitive student and research data, with records now appearing on dark web marketplaces.
- NCSC Advisory: Latest NCSC alert warns UK organisations of an uptick in supply chain compromises linked to vulnerable managed service providers. Emphasis on reviewing third-party access and patch management.
Trend: Increased targeting of logistics and education sectors, often through supply chain and IT service dependencies.
Takeaway: Monitor supplier access closely and integrate third-party risk assessments into incident response planning to reduce exposure to cascading breaches.
October 2025
- Transport for London: Ongoing ransomware incident affecting approximately 5,000 customers with potential compromise of bank account details and Oyster refund data.
- British Library: Ransomware attack in late 2024 continues to have impacts, with stolen data including internal HR documents, passports and staff personal information still circulating.
- Government Survey Findings Released: UK Cyber Security Breaches Survey 2025 reveals 37% of all UK businesses experienced phishing attacks; impersonation of organisations in second place at 15% of businesses.
Trend: Public sector and critical infrastructure increasingly targeted.
Takeaway: Even well-resourced organisations face prolonged recovery periods. Have robust backup and recovery plans tested regularly.
September 2025
- Collins Aerospace: Ransomware attack paralysed UK airports including Heathrow and Brussels.
- Jaguar Land Rover: Factory shutdown following ransomware, highlighting automotive sector risks.
- Retail, healthcare, education: Data breaches and ransomware still on the rise.
Trend: Aviation and automotive hit hard; vendor risk exposed.
Takeaway: Strengthen incident response and audit suppliers.
August 2025
- ShinyHunters: Salesforce & major brands like Google, Cisco and Pandora hacked; millions of contacts leaked.
- TransUnion & Pandora: OAuth token theft hit finance and retail.
- BlackCat/ALPHV: Ransomware wave continues across UK schools and telecoms.
Trend: Supply-chain and social engineering attacks escalate.
Takeaway: Train staff and review SaaS/app permissions.
July 2025
- Qantas & Co-op UK: Supply chain breaches exposed customer records.
- Microsoft SharePoint: Zero-day vulnerabilities actively exploited.
- Allianz Life & Dollar Tree: Millions of staff and customer records lost.
Trend: Exploitation of business-critical platforms.
Takeaway: Patch productivity software with urgency.
June 2025
- Kettering Health: Dual ransomware attacks hit both hospitals and patient data.
- Global breach: 16 billion credentials leaked in the largest data dump recorded.
- Ahold Delhaize, United Natural Foods: Retail and supply chain sectors affected.
Trend: Credential leaks and healthcare ransomware spike.
Takeaway: Focus on password hygiene and data governance.
May 2025
- Ascension Health, Synnovis, Co-op & Harrods: Supply chain & ransomware attacks impacted millions of records.
- SAP NetWeaver: Zero-day exploited globally, affecting UK retail and finance.
- Coca-Cola, Victoria's Secret, Adidas: High-profile corporate data breaches.
Trend: Retail, government & finance caught in the crosshairs.
Takeaway: Demand vendor audits and rehearse incident response.
April 2025
- Yale New Haven Health: 5.5 million UK patient records compromised.
- Marks & Spencer: Retail ransomware stopped delivery and froze gift cards.
- Blue Shield & Cleo Software: Multi-million data breaches due to SaaS vendor exploits.
Trend: SaaS and healthcare are prime targets.
Takeaway: Review SaaS + cloud security posture regularly.
March 2025
- Oracle Cloud: 6 million user records exposed through SSO/LDAP exploits.
- X (Twitter): Record DDoS from "Dark Storm Team" caused major outage.
- NTT Communications: Thousands of UK businesses suffered knock-on effects from a major breach.
Trend: Authentication, supply chain and cloud platforms targeted.
Takeaway: Patch fast and monitor your developer environments.
February 2025
- Lee Enterprises: Ransomware disrupted 75+ UK news outlets, stealing hundreds of gigabytes of data.
- Bybit Exchange: �1.5bn in cryptocurrency lost in a record-breaking theft with North Korea links.
- Orange & Mars Hydro: Large breaches affecting telecom and smart devices sectors.
Trend: Ransomware surge plus crypto and media attacks.
Takeaway: Financial and media firms are key targets.
January 2025
- TalkTalk: Third-party breach exposed 18.8 million UK customer records.
- Gravy Analytics: Mishandled cloud credentials led to millions of precise location records leaking online.
- Volkswagen & NHS: Both hit by ransomware; NHS education sector severely impacted.
Trend: Third-party and supply-chain risk running rampant.
Takeaway: Vendor security needs executive attention.