Key takeaways

  • The Financial Times reports that the hacking groups hitting UK organisations increasingly fit a new profile: young, western and reckless, and adept at manipulating people rather than only machines.
  • Loose collectives such as Scattered Spider, drawn from the wider online “Com” ecosystem, and the earlier Lapsus$ group, have been linked by researchers and prosecutors to high-profile 2025 disruption.
  • The 2025 attacks on Marks & Spencer, the Co-op and Harrods showed how help-desk social engineering can cripple operations; the Co-op said data on around 6.5 million members was affected.
  • The National Cyber Security Centre called ransomware one of the most acute threats to UK organisations and logged a record number of nationally significant incidents in its 2025 review.
  • Boards face mandatory ICO breach reporting within 72 hours, rising cyber-insurance costs and a policy push through the Cyber Security and Resilience Bill.

The face of cybercrime in Britain is changing, and it is younger than many boardrooms expected. The Financial Times, in its Risk Management: Cyber Security coverage, reports that the hacking groups behind a wave of attacks on UK organisations reveal a shifting profile — what it describes as the new cyber threat: young, western and reckless. It is a characterisation that upends the familiar picture of shadowy, state-backed operators working from distant time zones, and replaces it with something closer to home: English-speaking, internet-native and, in several cases, still in their teens.

For UK companies, the implications are uncomfortable. A generation of attackers that grew up online understands corporate systems, customer-service scripts and human psychology instinctively. They do not always need sophisticated malware to cause havoc. A convincing phone call to an IT help desk can be enough. The result, as 2025 demonstrated across the retail sector, is that disruption of national significance can begin not with a zero-day exploit but with a persuasive conversation.

This article examines the changing threat landscape, the lessons from recent UK incidents, the economics that make cybercrime so persistent, and the roles of the National Cyber Security Centre (NCSC), the Information Commissioner’s Office (ICO) and the insurance market. It focuses throughout on the threat, defence and policy — not on the mechanics of any attack — and treats July 2026 specifics as reported by the FT while grounding the wider picture in publicly available material.

The changing threat profile: young, western and reckless

For years, the dominant narrative around serious cyber intrusions centred on nation-state actors and organised criminal syndicates operating largely from Russia, China, Iran and North Korea. Those threats have not gone away. But alongside them, security researchers and law-enforcement agencies have tracked the rise of loosely organised, financially motivated collectives whose members are often based in Western countries, communicate in fluent English and coordinate through online communities.

The best known of these is the cluster of activity that vendors label Scattered Spider — also tracked under other names by different firms. It is not a conventional, hierarchical gang. Analysts describe it as a fluid grouping that emerges from a broader online subculture sometimes referred to as “the Com”: a sprawling, English-speaking ecosystem of chat channels and forums where young people trade techniques, boast about exploits and drift between pranks, fraud and serious crime. The earlier group Lapsus$, which drew attention in 2022 for brazen intrusions at major technology companies, came from a similar milieu and included young members.

What makes this profile distinctive is not raw technical brilliance but social fluency. These actors are, above all, skilled manipulators. They exploit the fact that behind every login screen and password reset sits a human being who can be persuaded, pressured or deceived. The US Cybersecurity and Infrastructure Security Agency (CISA), in a joint advisory, has characterised Scattered Spider as a group that relies heavily on social-engineering techniques and on impersonating employees to obtain access. That reliance on manipulation rather than malware is precisely what the FT’s “reckless” framing captures: attackers who are willing to take risks, court publicity and target household names, sometimes with little apparent regard for consequences.

The “reckless” element carries a paradox. Recklessness makes these actors dangerous — they move fast, escalate aggressively and cause outsized damage. But it also makes them vulnerable. Bravado, sloppy operational habits and a taste for notoriety leave trails that investigators can follow, which helps explain the arrests seen over the past two years.

Recent UK attacks and the techniques behind them

The clearest illustration of this threat arrived in spring 2025, when a series of attacks struck some of Britain’s best-known retailers. Marks & Spencer, the Co-op and Harrods were all hit within a short window, forcing systems offline, disrupting online ordering and, in M&S’s case, leaving shelves with visible gaps as logistics were affected. The NCSC, in its 2025 Annual Review, pointed to the retail attacks as emblematic of ransomware’s real-world impact, noting that incidents affecting companies such as M&S and the Co-op resulted in operational disruption and empty shelves.

The scale of the harm was considerable. The Co-op confirmed that data relating to a large number of members was affected, with reporting putting the figure at around 6.5 million member records. Industry estimates of the combined financial impact of the M&S and Co-op incidents have ranged widely, with figures cited in the region of £270 million to £440 million when treated as a single combined cyber event — numbers that should be read as estimates rather than audited losses.

At a high level, and without describing any method that could enable wrongdoing, the common thread investigators and security firms have highlighted is social engineering aimed at the human perimeter — in particular, the manipulation of IT help desks and support processes to obtain or reset access. The lesson for defenders is not a technical secret; it is a governance point. Identity verification, the handling of password and access-reset requests, and the vigilance of front-line support staff are now core security controls, not administrative afterthoughts.

Law enforcement responded visibly. In July 2025, the National Crime Agency (NCA) announced the arrest of four people in connection with the retail attacks — reported as two 19-year-old men, a 17-year-old and a 20-year-old woman — on suspicion of offences including Computer Misuse Act breaches, blackmail, money laundering and participation in organised crime. Paul Foster, who leads the NCA’s cybercrime unit, said the investigation was one of the agency’s highest priorities and that officers were working at pace. Those arrested have not, at the time of writing, been convicted of the retail offences, and reporting on individuals should be treated with appropriate caution. Separately, prosecutions connected to the broader Scattered Spider phenomenon have continued into 2026, including sentencing linked to an attack on Transport for London.

The economics of ransomware

To understand why this threat persists, it helps to follow the money. Modern cyber extortion is a business, and a professionalised one. The dominant model is ransomware-as-a-service (RaaS), in which a core group develops and maintains the extortion tooling and infrastructure, then rents it to “affiliates” who carry out intrusions in exchange for a share of any proceeds. This division of labour lowers the barrier to entry: an affiliate does not need to build sophisticated capabilities from scratch, only to gain access — which is where socially fluent, English-speaking actors have an edge.

The commercial logic also explains the shift towards “double extortion”, in which criminals both encrypt systems and steal data, then threaten to publish it. That combination increases pressure on victims to pay, because restoring backups no longer neutralises the threat of a damaging leak. It also drags in a wider circle of victims — customers, suppliers and employees whose personal data may be exposed.

The financial pressure on the target side is intensifying. Insurance Times reported that initial cyber ransom demands grew by 47% in 2025, while The Register, citing market data, reported a 230% increase in UK cyber-insurance payouts driven by ransomware. Such figures come from insurers and vendors rather than official statistics and can vary by methodology, but the direction of travel is consistent: demands are rising, claims are rising and the cost of an incident increasingly extends well beyond any ransom itself, into remediation, downtime, legal exposure and reputational harm.

Crucially, the NCSC and law-enforcement bodies continue to discourage payment. Paying a ransom does not guarantee data recovery, may not prevent publication of stolen material and helps sustain the criminal economy that funds the next attack. It is a message aimed squarely at boards weighing short-term operational relief against long-term systemic risk.

The role of the NCSC and the ICO

Two institutions sit at the centre of Britain’s response. The NCSC, part of GCHQ, is the national technical authority for cyber security. Its 2025 Annual Review struck a notably urgent tone, describing ransomware as one of the most acute and pervasive threats to UK organisations and reporting a record number of nationally significant incidents handled during the review period. The review also warned of a widening gap between the scale of the threat and the collective level of national defence — a theme its leadership, under chief executive Richard Horne, has pressed in public remarks urging organisations to treat cyber resilience as a board-level priority rather than a purely technical concern.

The NCSC’s practical role is broad: it publishes guidance, runs services such as its Early Warning and Cyber Essentials schemes, coordinates incident response for the most serious events and issues advisories when new threats emerge. Its guidance on topics such as multi-factor authentication, secure system administration and incident planning is freely available and forms a sensible baseline for organisations of all sizes.

The ICO plays a complementary, regulatory role focused on personal data. Under the UK GDPR and the Data Protection Act 2018, organisations must report a notifiable personal-data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, those affected must also be informed. Enforcement can be significant: the most serious infringements can attract fines of up to £17.5 million or 4% of global annual turnover, whichever is higher. Beyond penalties, the ICO’s public breach records and enforcement actions create a strong reputational incentive to prepare properly and respond transparently.

Together, the NCSC and ICO reflect the two halves of Britain’s approach: technical resilience and accountability for the protection of personal data.

Building defence and resilience

If the threat has shifted towards the manipulation of people and processes, so must the defence. The encouraging news is that much of what works is well understood and does not require exotic technology. It requires discipline.

At the identity layer, phishing-resistant multi-factor authentication, tightly controlled privileged access and rigorous verification for account-recovery and help-desk requests directly address the social-engineering routes that recent attacks exploited. Because so many intrusions begin with a convincing request rather than a technical flaw, the process by which a support agent confirms who they are talking to has become a genuine security control.

At the organisational layer, resilience means assuming that some attacks will succeed and planning to limit the damage. That includes segmenting networks so an intruder cannot move freely, maintaining tested and offline backups so recovery does not depend on paying anyone, and rehearsing incident-response and crisis-communications plans before they are needed. The retail incidents underlined that the hardest problems in a crisis are often operational and reputational, not purely technical: keeping stores stocked, customers informed and staff supported.

Culture matters as much as controls. Staff who feel able to report a suspicious call or a mistake quickly, without fear of blame, give an organisation precious time to respond. Regular, realistic training that reflects current social-engineering tactics is more useful than an annual tick-box exercise. And supply-chain scrutiny is essential: attackers frequently reach large targets through smaller, less-defended partners, so due diligence cannot stop at the corporate boundary.

For smaller businesses, the NCSC’s Cyber Essentials scheme offers an accessible starting framework, and government-backed guidance is free to use. Resilience is not the preserve of large enterprises with big security budgets; the fundamentals scale down.

Impact on businesses, consumers and the economy

The consequences of this threat ripple outwards. For businesses, a serious incident can mean weeks of disruption, lost sales, remediation costs, regulatory scrutiny and lasting reputational damage. The M&S and Co-op episodes showed that even financially robust, well-run companies can be knocked off balance, and that recovery can be measured in months rather than days.

For consumers, the most tangible harms are exposure of personal data and the fraud and anxiety that can follow, alongside the everyday inconvenience of disrupted services. When millions of records are potentially affected, the ripple effect on public trust is significant, and individuals bear the ongoing burden of vigilance against follow-on scams.

For the wider economy, the picture is one of rising friction. Cyber risk raises the cost of doing business — through security investment, insurance premiums and compliance — and can deter digital investment if confidence erodes. Yet it also drives a growing domestic cyber-security sector and has prompted a policy response, including the Cyber Security and Resilience Bill, which aims to strengthen requirements for operators of essential and digital services and to widen the scope of regulated organisations. The intended effect is a more resilient national infrastructure, though the balance between regulatory burden and security benefit will be closely watched.

Opportunities, challenges and material risks

The current moment presents opportunities as well as threats. Heightened board awareness is unlocking overdue investment in identity security, monitoring and resilience. The visibility of arrests and prosecutions signals that reckless, publicity-hungry attackers are not beyond the reach of law enforcement, which may have a deterrent effect over time. And the maturing insurance market, for all its rising costs, is pushing better security practices as a condition of cover.

The challenges are equally real. Social-engineering attacks are hard to eliminate because they exploit human trust, which cannot be patched. The RaaS model keeps the barrier to entry low. A persistent cyber-skills gap leaves many organisations under-resourced. And the “reckless” character of the newer collectives makes their behaviour less predictable and their willingness to disrupt critical services more concerning.

The material risks for any organisation, therefore, run from operational shutdown and data loss to regulatory penalties, litigation, uninsured losses and reputational harm — risks that now sit firmly within enterprise risk management rather than the IT department alone. Boards that treat cyber as a strategic risk, resource it accordingly and rehearse their response are materially better placed than those that do not.

Balance and perspective

It is important not to overstate the novelty here. Young offenders have long featured in cybercrime, and most attacks against UK organisations still fail or are contained. Basic hygiene — patching, strong authentication, backups and staff awareness — continues to defeat the majority of intrusions. The rise of young, English-speaking collectives is a meaningful shift in profile, not a wholesale replacement of the threat landscape; state-sponsored actors and traditional organised crime remain serious concerns. The proportionate response is neither complacency nor alarm, but sustained, well-governed investment in resilience.

What happens next

Expect the pressure to persist through the remainder of 2026. Law-enforcement action against members of these collectives is likely to continue, and further prosecutions may follow the arrests and sentencing already seen in connection with the retail attacks and the Transport for London incident. The NCSC is likely to keep pressing its message that resilience must be owned at board level, and the passage and implementation of the Cyber Security and Resilience Bill will shape compliance obligations for a widening range of organisations.

On the market side, cyber-insurance costs and conditions will bear watching, as insurers respond to rising claims by tightening underwriting and demanding stronger controls. And the social-engineering techniques at the heart of recent incidents will keep identity security, help-desk verification and staff awareness near the top of the corporate agenda. Organisations that act now — testing their response plans, hardening their access controls and scrutinising their supply chains — will be better prepared for whatever profile the next wave of attackers takes.

Conclusion

The warning captured in the FT’s reporting is a useful corrective to outdated assumptions. The people most likely to disrupt a major UK organisation may not be distant, state-directed professionals but young, English-speaking and reckless actors who understand systems and people alike. That should not induce panic. It should sharpen focus. The defences that matter most — strong identity controls, disciplined processes, tested resilience and a culture that empowers staff to speak up — are within reach of any well-run organisation. The task for boards is to treat cyber risk as the strategic, enterprise-wide issue it has become, and to build the resilience that turns a potential crisis into a manageable incident.