NCSC Warns Businesses After Surge in ‘Nationally Significant’ Cyber Incidents

Businesses in the UK have been urged to take urgent action following a sharp rise in serious cyber incidents over the past year.

The National Cyber Security Centre (NCSC) reported that the number of nationally significant incidents those with the potential to cause widespread disruption surpassed 200, more than double the total from the previous year.

Rising Threats and Increasing Impact

Richard Horne, CEO of the NCSC, said these high-level incidents now account for roughly half of all reports handled by the centre’s incident management team.

‍

“On average, the NCSC has dealt with four nationally significant incidents a week,” Horne noted. “That is a 50% increase on the previous year and the third consecutive year of growth.”

‍

Among these, 18 were classified as “highly significant” attacks, meaning they could seriously affect central government, essential services, a large portion of the population, or the wider economy.

Defenses Are Improving, But Risks Grow

Despite the headline numbers, Horne emphasized that most cyberattacks still fail due to strong organisational defenses. “We are seeing more organisations continue operating even when an attack breaks through, because they were prepared,” he said.

However, he warned that attackers are becoming more sophisticated and more capable of causing significant harm. “They don’t care who they hit or how they hurt them,” Horne added.

Ransomware Remains a Major Concern

Ransomware continues to pose one of the most serious threats to UK businesses, with high-profile attacks on Marks & Spencer, the Co-op, and Jaguar Land Rover causing major disruptions. A contributing factor to the rise in serious incidents is a small number of attackers exploiting vulnerabilities at scale. Three known flaws in Microsoft SharePoint and other products accounted for 29 incidents managed by the NCSC last year.

‍

The UK faces persistent threats from state-linked actors. China has targeted a wide range of sectors, including a botnet operation using 260,000 computers to launch attacks. Other geopolitical tensions are also driving cyber activity. Russia’s invasion of Ukraine and the Israel-Gaza conflict have inspired hacktivist groups to target UK and European organisations. Iran-linked hackers have focused on critical infrastructure, while North Korea-linked actors are reportedly posing as freelance IT workers and targeting UK crypto firms.

Beyond Technology: Real-World Consequences

Horne stressed that the impact of cyberattacks goes far beyond IT systems. “They affect growth, prosperity, safety, national security, reputations, and the bottom line,” he said.

‍

Executives without a plan face particularly high stress. “I have sat in too many rooms with individuals deeply affected by attacks on their organisations,” Horne said. “The disruption impacts staff, suppliers, customers, and the teams working around the clock to restore operations.”

‍

Shirine Khoury-Haq, CEO of The Co-op Group, echoed his concerns, highlighting the unpredictable intensity of live attacks. “The attack has had a significant impact on me, my colleagues, and our members,” she said, though she emphasized the value of cyber drills in building preparedness.

Preparing for the Unthinkable

Horne warned that every business leader must have a plan both to defend against criminal cyberattacks and to maintain operations if systems are compromised.

‍

“If your IT infrastructure was crippled tomorrow and all your screens went blank, could you run payroll, keep machinery working, or stock your shelves? If the answer is no, act now,” he said.

‍

To support businesses, the NCSC has launched a Cyber Action Toolkit for small companies and sole traders, which includes free cyber insurance and a dedicated helpline. A Cyber Governance Training programme is also available for senior leaders and board members to strengthen organisational cyber readiness.