Introducing Episode 19 of our expertly crafted series on data breaches, cyber-attacks, and more. Breach Breakdown is your go-to source for recapping incidents and staying up-to-date on the latest solutions. April saw its fair share of reported cases, with with breaches highlighting critical vulnerabilities affecting UK infrastructure and professional services:
Rising Nation-State Cyber Threats Target SMBs: Why Stronger Security Is Essential
Nation-state cyber threat groups are increasingly targeting small and medium-sized businesses (SMBs), especially those linked to larger companies in the supply chain. Many SMBs underestimate their risk, making them vulnerable to phishing, ransomware, and software exploits. Recent data shows ransomware affects 70% of small and 90% of midsize businesses’ security incidents.
SMBs play a critical role in supply chains and must strengthen cyber security by adopting multifactor authentication (MFA), endpoint detection and response (EDR), and managed detection and response (MDR). Employee training and timely incident reporting are also vital. Leveraging these measures helps SMBs protect themselves and the wider networks they support from evolving nation-state threats.
Read More:
M&S Faces Financial and Operational Crisis Following Cyber Incident
Over the past weeks, major UK retailers Marks & Spencer, Co-op, and Harrods have all faced significant cyber incidents, exposing the growing risks within the retail sector. M&S has struggled with disruptions affecting contactless payments, online order processing, and automated inventory systems, leading to widespread operational challenges and a nearly 10% drop in share value.
At the same time, Co-op was forced to restrict remote work access and tighten security protocols following a hacking attempt on its IT infrastructure.
Harrods also took precautionary measures by limiting internet access at its locations after attempts to gain unauthorised access to its systems. While the full details of these breaches remain under investigation, the financial and operational impacts are clear.
These incidents underscore how cyber criminals are employing increasingly sophisticated tactics such as ransomware and supply chain attacks, putting retailers of all sizes at risk.
The experiences of M&S, Co-op, and Harrods serve as a critical reminder that continuous investment in robust cyber security measures is essential to protect businesses, customers, and brand reputation from costly breaches.
Read More:
Cyber attacks on Vehicles Surge 45%, with Ransomware and EV Charger Exploits on the Rise
Cyber security incidents targeting the automotive industry surged by nearly 50% in Q1 2025, with ransomware attacks on manufacturers making up 45% of reported incidents. One notable attack saw Tata Technologies, an automotive and aerospace provider, fall victim to ransomware, with over 730,000 stolen files leaked to the Dark Web. As attackers increasingly focus on exploiting OEM credentials to manipulate vehicles or steal sensitive data, the industry faces escalating threats. Electric vehicle (EV) chargers are also emerging as a growing vulnerability, with cyber attacks against them rising by 39% since 2023.To combat these threats, steps such as strengthening multi-factor authentication (MFA) for sensitive access, regular patching of software and firmware, encryption of data, AI-driven threat detection systems, and comprehensive employee training to prevent phishing attacks are advised. These steps are essential as the automotive and mobility industries face a growing wave of cyber criminal activity.
Read More:
Law Firm Fined £60,000 After Sensitive Data Exposed in Cyber Attack
DPP Law Ltd, a Merseyside-based law firm, has been fined £60,000 after a cyber attack exposed sensitive client information on the dark web. The breach occurred due to the firm’s failure to implement multi-factor authentication (MFA) on an administrator account, which allowed hackers to steal over 32GB of data. Despite the severity of the breach, DPP did not report the incident until 43 days after being alerted by the National Crime Agency.
The fine underscores the need for robust cyber security measures, including MFA, regular vulnerability scans, and timely patching of systems. The law requires all organisations take proactive steps to protect sensitive data, as failure to do so can lead to significant financial and reputational damage.
Read More:
Hackers Exploit Zoom Remote Control Feature for Crypto Theft
A hacking group called “Elusive Comet” is using Zoom’s remote control feature to target cryptocurrency users in social engineering attacks. The attackers trick victims into granting remote access to their computers during Zoom calls, often posing as legitimate interview invitations from fake “Bloomberg Crypto” accounts. Once access is granted, the hackers can steal sensitive data, install malware, and initiate crypto transactions.
This attack mirrors tactics used in the $1.5 billion Bybit hack and relies on deceiving users into approving seemingly harmless Zoom prompts. To defend against this threat, experts recommend implementing Privacy Preferences Policy Control (PPPC) to block unauthorised access and, for high-risk environments, removing Zoom entirely in favor of browser-based alternatives.
Read More: