Emerging Threats:

Cyber Risk Surge:

“The streets aren’t the only place getting dangerous- the ops are spinning the block in your emails”

I don’t know if you’ve seen the news recently, but M&S are really going through it.

Cast your mind back to sitting in the pub garden, sun beaming on your face on the April Easter bank holiday. While you were downing pints, looking for where the function is, M&S were being hacked by a cybercriminal syndicate called “SCATTERED SPIDER”.

M&S had to stop taking online orders entirely and the Bank of America Analysts believe M&S have lost £40mil of sales every week since. Apparently, according to infosecurity magazine, hackers used the “DRAGON FORCE” encryptor on M&S VMware ESXi hosts to encrypt virtual machines likely associated with “scattered spider”.

For those of us who don't speak Cyber, hackers from a group called Scattered Spider broke into Marks & Spencer’s internal systems by pretending to be IT staff and tricking the company’s real IT helpdesk into resetting a staff member’s password and turning off security protections. Red Flag.

SO what am I getting at with this, well, M&S cyber attack disruptions are said to last until July and will hit their yearly profit by around £300M…that’s one big gorilla, and your company is one small man. You likely don't have the budget, the tools, the people, you don't have the facilities for this big man.
According to the Department for Science, Innovation & Technology, 43% of UK businesses (that’s over 612,000) reported a cyber attack last year. And among those, phishing was the biggest threat, 85% of incidents came from dodgy emails and social engineering. Just like this one.

Phishing and Spoofing:

“Action Fraud have reported that within their Suspicious Email Reporting Service (SERS) they received over 2,924 reports in March 2025, a staggering increase compared to only 133 reports made in February 2025.”

Most cyberattacks start with a trick a lot of you with toxic exes might recognise: pretending to be someone you trust. That’s exactly how Scattered Spider broke into M&S, by faking their identity, manipulating emotions (IT protocols), and getting what they wanted before ghosting. Classic.

Phishing and Spoofing, digital fake friend energy.
Action Fraud’s Suspicious Email Reporting Service (SERS) received over 2,924 reports in March 2025 alone, up massively from just 133 reports in February. That’s not just a wave, that’s a tsunami.
If one of your employees clicks the bad link you’re finished.

Phishing and spoofing attacks aim to:

• Steal credentials – tricking staff into giving up usernames and passwords
• Bypass security – faking emails or caller IDs to reset logins or unlock systems
• Deliver malware – via fake invoices, calendar invites, or job applications
• Exploit trust – impersonating your CEO, suppliers, or even you

A 2024 Yubico Global Survey (Talker Research, 20,000 participants across 10 countries) found that 50% of employees experienced a cyberattack at work in the last year. Yet only 23% of affected companies followed up with cybersecurity training. Make it make sense.

Emotional & Reputational Damage:

Beyond the money, there’s your reputation. If phishers spoof your company email to scam your customers or suppliers…

Your reputation?! Damaged
Trust in your company?! Eroding
Clients and revenue?! Where?

In today’s connected world, news of a data breach or scam spreads quickly, other companies will want to tarnish your rep by saying you haven’t got your cyber security locked down, they’ll try and put you down, put your company first. You don’t want to have to rebuild your brand image.

So what can you do about it today?

Invest in training, it’s really important
Not in a mean way, but you should try and catch your staff out :\
Super controversial I know but this is the best way to target members of staff who might need further training in cyber security awareness and keeping their information safe

Strengthen protocols – MFA, password managers, how about reviewing those employee password policies.