What UK Businesses Can Learn From the M&S and Co-op Cyber Attacks
Cyber security is no longer only an IT issue. Attacks on some of the UK’s best known organisations have shown how quickly a cyber incident can affect customers, operations, revenue, reputation and the people responsible for keeping a business running.
The latest UK Government Cyber Security Breaches Survey found that 43% of businesses identified a cyber breach or attack in the previous 12 months. That is estimated to represent around 612,000 UK businesses. Only 25% of businesses reported having a formal incident response plan.
Table of Content:
The M&S Cyber Attack: When Digital Disruption Becomes Business Disruption
In spring 2025, Marks & Spencer experienced what it described as a sophisticated and targeted cyber attack. The incident disrupted parts of its operations and forced the retailer to take measures to contain the problem and stabilise its systems.
The consequences reached far beyond the technology team. M&S reported reduced food availability, additional waste and logistics costs, and disruption to online trading. In its full year results, the business initially estimated an impact of around £300 million on 2025/26 operating profit before mitigation, insurance and trading actions. Later reporting showed substantial direct recovery, risk management and specialist advisory costs.
The lesson for employers is important: a cyber attack can interrupt the systems that everyday business processes depend on. Ordering, stock management, customer service, communications, payments and supply chains can all be affected when technology becomes unavailable or compromised.
The Co-op Cyber Attack: The Cost Of Containing A Threat
Co-op also experienced a major criminal cyber attack in 2025. During its investigation, the organisation confirmed that attackers had accessed and extracted data from one of its systems, including names and contact details relating to a significant number of current and past members. Co-op stated that the accessed information did not include passwords, bank or credit card details, transaction information or information about members’ products and services.
Containment itself created significant disruption. In March 2026, Co-op said its decision to restrict systems during the incident had an estimated £285 million direct impact on revenue and an estimated £107 million impact on profitability.
This demonstrates a difficult reality of cyber security. Sometimes the actions needed to protect a business can also interrupt normal operations. Organisations therefore need people who understand security procedures, can recognise suspicious activity, know when to escalate an incident and can support a controlled response.
What Do These Incidents Tell UK Employers?
High profile attacks attract attention because of the organisations involved, but the underlying risks are relevant to businesses of every size. The 2025/26 Cyber Security Breaches Survey found that 46% of small businesses, 65% of medium businesses and 69% of large businesses had identified a breach or attack in the previous 12 months.
Cyber incidents can become operational incidents, affecting sales, service delivery and productivity.
Customer and employee data can become a target, creating legal, reputational and communication challenges.
Early detection matters because the faster unusual activity is identified and escalated, the sooner an organisation can respond.
Security culture matters because cyber security depends on the decisions and behaviours of people across the organisation, not only specialist software.
Incident response planning matters because businesses need clear responsibilities and procedures before an attack happens.
Why Cyber Security Skills Matter Inside Your Organisation
The challenge is not simply buying more technology. Businesses also need people who can use security tools correctly, follow procedures, monitor activity and help colleagues understand their responsibilities.
Government research published in 2026 found that 57% of businesses had a basic technical cyber security skills gap. It also found that 47% of people responsible for cyber security in businesses who had not outsourced the function lacked confidence in dealing with cyber breaches or attacks.
For employers, developing cyber capability internally can help create a stronger first line of defence and build security into everyday working practices.
How A Level 3 Cyber Security Technician Apprentice Can Support Your Business
The Cyber Security Technician Level 3 apprenticeship is designed around practical first line cyber security support. Apprentices develop the knowledge and skills to monitor and report security events, maintain security controls, support access management, contribute to vulnerability assessments, carry out risk assessments and help develop cyber security awareness.
Monitor and report information security events so suspicious activity can be identified and escalated.
Support technical security controls including patching, software updates, access controls, firewalls and security monitoring tools.
Review access rights and help ensure people have appropriate access to systems, services and data.
Support vulnerability assessments and help identify threats, vulnerabilities and risks.
Contribute to cyber security awareness so colleagues understand how their actions can reduce risk.
Document incidents and support compliance checks, reporting and evidence gathering.
An apprentice is not a replacement for an organisation’s complete cyber security strategy or specialist incident response support. However, developing someone with practical cyber security responsibilities can strengthen day to day monitoring, improve awareness and give your organisation more capability to recognise and respond to potential threats.
Develop Existing Staff Or Recruit New Cyber Talent
The apprenticeship can support employers that want to develop an existing employee into a cyber focused role, as well as organisations looking to recruit new talent.
Momentous Learning can support employers with apprenticeship training, help them understand the funding and incentives they may be eligible for, and provide a free apprentice recruitment service for businesses looking to bring someone new into the team.
With cyber risks affecting organisations across retail, finance, healthcare, manufacturing, professional services and the public sector, building practical cyber capability is becoming an important part of business resilience.
Build Cyber Capability Before An Incident Tests It
The M&S and Co-op incidents show that cyber attacks can have consequences far beyond a compromised device or account. They can affect customers, colleagues, suppliers, revenue and the ability to operate normally.
Investing in people who can identify threats, maintain controls, support security awareness and respond appropriately to security events can help businesses become better prepared.
Want to explore the Cyber Security Technician Level 3 apprenticeship for your organisation?
Speak to Momentous Learning about developing an existing employee or recruiting new cyber talent, and we can also help you understand the apprenticeship funding and incentives that may be available.
