April 2025 has brought a mix of major cyberattacks, emerging threats, and important regulatory developments. From disruption at M&S to a malware risk triggered by a simple misprint, organisations continue to grapple with persistent vulnerabilities. Meanwhile, the UK government has announced plans for a new Cyber Security and Resilience Bill, aiming to strengthen supply chain security and broaden regulatory oversight.
Read on for this month’s key incidents, trends, and what they could mean.
Cyberattack hits M&S operations, disruption lingers despite recovery efforts
Popular retail chain Marks & Spencer has confirmed it is dealing with the fallout from a significant cyber-attack that has caused disruption across its UK retail operations. The incident, which began mid-April, prompted the retailer to take parts of its system offline in a bid to protect its infrastructure and customer data.
Initially, customers experienced issues with in-store payment terminals and order collections, leading to confusion and mounting frustration. A company notice acknowledged the cyber incident and outlined operational changes implemented as a precaution. While M&S reassured customers that its website, app, and stores remain open, many reported otherwise on social media, with some shops experiencing outages severe enough to shut early or revert to cash-only transactions.
Where are things now?
Though contactless payments have since been restored, according to M&S, conflicting reports from customers suggest ongoing problems. Click-and-collect services have also been paused, and the retailer has advised customers not to visit stores until they receive confirmation that their order is ready (advice that some say hasn’t matched the reality in-store).
The company has not disclosed the nature of the cyber-attack, but its decision to move systems offline and the involvement of the National Cyber Security Centre and the National Crime Agency suggest a potentially serious breach, possibly related to ransomware. External cybersecurity experts have been called in to assist, and authorities actively support the investigation.
M&S has assured customers that service remains a priority, but the incident has exposed the retailer’s vulnerability and left many shoppers questioning the effectiveness of its communication and crisis response.
Stormont probes malware risk after misprinted web address on 295,000 rates bills
A major cybersecurity concern has arisen in Northern Ireland after almost 300,000 ratepayers received bills featuring an incorrect web address. The misprinted link, found on Land and Property Services (LPS) correspondence, closely resembled the official NI Direct site but instead directed users to a potentially harmful domain.
Cybersecurity experts identified the issue as "typo-squatting", where scammers exploit small URL errors to lure users into visiting malicious websites. He noted that the site attempted to download malware. The Department of Finance has referred the matter to Action Fraud, the UK’s national fraud and cybercrime reporting centre, and has corrected the error in future mailings. Officials advise ratepayers to use the official NI Direct website and report any concerns to LPS. This story highlights the importance of vigilance when clicking on website links.
UK unveils Cyber Security & Resilience Bill advancements aimed at tougher security and regulatory powers
The UK government has outlined plans for its Cyber Security and Resilience Bill, aiming to strengthen digital defences and expand regulatory powers. The Bill will bring MSPs and certain data centres under stricter oversight, introduce tougher supply chain security duties, and formalise best practice through the NCSC’s Cyber Assessment Framework.
Regulators like the ICO will gain stronger powers to collect data, enforce compliance, and recover costs. New rules will also mandate faster incident reporting, with initial notifications required within 24 hours. Beyond this, the Secretary of State will have flexible powers to update regulations, and further measures such as national security directions and a long-term regulatory strategy are under consideration. Final details will be confirmed when the Bill reaches Parliament. We’ll keep you updated!
Onboard market-leading cybersecurity tools
This month’s events underline both the growing impact of cyber threats and the need for stronger defences. From ransomware shutdowns to simple URL typos exposing users to malware, attackers continue to exploit gaps wherever they find them.
As high-profile breaches shake public trust, the UK’s proposed Cyber Security and Resilience Bill signals a tougher, more proactive regulatory approach. Faster incident reporting, wider oversight of MSPs, and stronger supply chain duties are set to reshape cybersecurity expectations.
Brigantia remains committed to helping organisations defend against growing digital threats. Contact us today to learn more about the latest cybersecurity solutions and how we can help keep your business secure.
Want to read more articles like this? Head to our resources page.
