The Critical Importance of Cybersecurity in Business
“Not if but when” is the resounding statement from Cybersecurity specialists in light of the recent cyberattacks on major UK companies like Marks & Spencer (M&S) and the Co-op. It serves as a stark reminder of the critical importance of robust cybersecurity measures in today's interconnected world. These incidents have not only disrupted business operations but have also raised serious concerns about data security and business continuity. Clearwave is currently exploring additional measures that it can take to protect itself and its clients should the worse happen.
Below we are outlining what has happened recently and why it is important to be aware and what measures should be taken to bolster your defences. Most importantly our Pegasus support system is a secure way for us to receive your support requests and for Clearwave to securely communicate with you.
The Recent Attacks
In April and May 2025, both M&S and the Co-op experienced significant cyberattacks.
- Marks & Spencer: M&S faced a ransomware attack that caused widespread disruption, including issues with contactless payments, online orders, and even stock shortages. The attack is believed to have been carried out by the Scattered Spider group, and involved the use of DragonForce ransomware and bad actors posing as IT Support personnel which allow them to reset users passwords.
- The Co-op: The Co-op also suffered a cyberattack, which led to the shutdown of some IT systems and the theft of customer data, including names and contact details, from a system used for current and former members.
Why These Attacks Matter
These attacks highlight several key vulnerabilities and the potential consequences of inadequate cybersecurity:
- Disruption of Operations: Cyberattacks can disrupt critical business operations, including online sales, supply chain management, and in-store services. This can lead to significant financial losses and damage to a company's reputation.
- Cost of recovery: The costs associated with recovering from a ransomware attack can be substantial and for smaller business it may well be catastrophic
- Data Breaches and Loss of Trust: When client data is compromised, it can lead to a loss of trust and damage the businesses relationship with its clients. This can have long-term consequences for client loyalty and business performance.
- Supply Chain Vulnerabilities: These attacks highlight the interconnectedness of supply chains, and how a breach at one point can impact a much larger network.
- Social Engineering: The attacks have shown the effectiveness of social engineering tactics, where attackers manipulate employees to gain access to systems.
The Importance of Cybersecurity Measures and practices
In light of these events, it is clear that all businesses must prioritise cybersecurity. Key measures include:
- Strong Password Policies and Multi-Factor Authentication (MFA): Implementing strong password policies and MFA can significantly reduce the risk of unauthorized access to systems. The attacks on M&S and Co-op involved social engineering tactics to reset passwords, highlighting the importance of MFA.
- Employee Training: Training employees to recognize and avoid phishing attempts and other social engineering tactics is crucial.
- Regular Security Audits and Vulnerability Assessments: Regularly assessing systems for vulnerabilities and conducting security audits can help identify and address potential weaknesses before they can be exploited.
- Incident Response Planning: Having a well-defined incident response plan in place is essential for minimizing the impact of a cyberattack and ensuring a swift recovery. M&S had issues with their incident response, according to some reports.
- Data Encryption: Encrypting sensitive data, both in transit and at rest, can help protect it from unauthorized access.
- Network Segmentation: Dividing networks into smaller, isolated segments can limit the spread of an attack if one segment is compromised.
- Investment in Security Technology: Investing in up-to-date security technologies, such as intrusion detection and prevention systems, firewalls, and anti-malware software, is essential.
- Third-Party Risk Management: Businesses need to carefully assess the security practices of their third-party suppliers and partners, as vulnerabilities in the supply chain can be exploited by attackers.
- Cybersecurity Awareness: Promoting a culture of cybersecurity awareness within the organization is crucial.
- Zero Trust Architecture: Implementing a Zero Trust security model, which assumes that no user or device should be trusted by default, can enhance security.
The Broader Context
These attacks are part of a growing trend of cyberattacks across the globe. Factors contributing to this trend include:
- Increased Reliance on Technology: Businesses are increasingly reliant on technology for everything from online sales to supply chain management, which expands the attack surface.
- The Growth of E-commerce: The growth of e-commerce has increased the amount of online transactions and the volume of client data that businesses handle.
- Sophisticated Cybercriminals: Cybercriminals are becoming increasingly sophisticated, using advanced techniques such as ransomware, phishing, and social engineering to target organizations.
- Talent Shortage: The shortage of skilled cybersecurity professionals makes it more challenging for organizations to defend against cyberattacks.
In summary
The cyberattacks on M&S and the Co-op serve as a wake-up call for UK Businesses. Organisations must recognize that cybersecurity is not just an IT issue but a business imperative. By investing in robust cybersecurity measures, businesses can protect their operations, safeguard client data, and maintain the trust of their clients. Failure to do so can have severe consequences, including financial losses, reputational damage, and legal liabilities.









