Topic · running coverage

Ransomware and cyber attacks in the UK: latest coverage

Everything we have published on ransomware and cyber attacks that affect UK organisations, in one place: the incidents, the data studies, the explainers and the buyer guides, with a short dated summary of where things stand. This page adds no new reporting. Each line links to the full piece.

600+

critical infrastructure organisations breached by SafePay since August 2024, per CISA, the FBI and the NCA

162

Microsoft 365 tenants with unauthorised sign-ins in the ConnectWise backup breach (Huntress)

28%

of organisations whose operations or data were affected by ransomware fully recovered all affected data (Veeam, 2026)

42

Servnet pieces gathered here: 24 news, 5 insights, 5 explainers, 8 research

Newest piece 21 Oct 2026 · summary checked 28 Oct 2026 · coverage since 8 Oct 2025

Where it stands

Where things stand, as of 28 Oct 2026

A short summary of what our coverage shows. Every point links to the piece it comes from, which has the full detail and its sources.

Incidents at UK-facing retailers clustered this autumn. TFG London, which owns Hobbs, Phase Eight and Whistles, confirmed an attack discovered on 11 October with some systems still unavailable two days later, the third fashion retailer linked to an incident or claim in just over a week after ASOS and H&M. Beyond fashion, Ahold Delhaize took systems offline on 12 October across the Netherlands, Belgium and the US.
Suppliers are a way in. A stolen ConnectWise Cloud Backup credential was used to reach customers’ Microsoft 365 tenants: Huntress saw unauthorised sign-ins across 162 tenants and ConnectWise suspended the service. Huntress warned that for an MSP, one vendor credential could be pivoted into every client it manages.
Joint advisories keep raising the count. CISA, the FBI and the UK’s National Crime Agency say SafePay has breached more than 600 critical infrastructure organisations since August 2024, and a CISA, FBI and HHS advisory says Medusa has passed 500 critical infrastructure victims since June 2021. Medusa has also claimed UK targets including HCRG Care Group and Gateshead Council.
Both groups go after recovery. SafePay deletes shadow copies and resets NAS devices; Medusa deletes shadow copies and backup files. In Veeam’s 2026 Data Trust and Resilience Report, only 28% of organisations whose operations or data were affected fully recovered everything, and Sophos says 79% of ransomware attacks in its dataset started with a compromised identity.
Operational technology is a target in its own right. Attackers set Danfoss refrigeration controllers to a 50°C target across hundreds of European supermarkets, and the NCSC says it handled more than 200 UK critical infrastructure incidents in the year to May 2026, around three quarters of them believed to be linked to states.
Not every measure is rising. Ransomware reports to the ICO peaked in 2023, and the government’s breaches survey put ransomware at 1% of UK businesses in 2025/26, down from 3%. Fewer incidents is not the same as smaller ones.
The UK still plans to ban ransom payments by public bodies and regulated critical infrastructure, with a notification rule for everyone else. When we last checked, on 19 September, no bill or timetable had been published.

Still unclear

Whether this autumn’s retail incidents share an attacker. The reporting we covered treats them as a sector pattern, not one confirmed campaign.
Whether Ahold Delhaize’s systems were encrypted. The company had not said so when we covered it on 12 October.
When ConnectWise Cloud Backup comes back. There was no restoration timeline when we covered the suspension on 20 October.
When the payment ban becomes law, and exactly who it will cover.

Where to start

Read these first

Four pieces that between them cover the basics, the decisions and the data. The full list is further down.

01 LearnWhat is ransomware, and how UK businesses really get hitThe basics, in plain English.02 InsightsRansomware 2026: how attacks changed, and the defenceWhat is different about attacks now, and what that means for defence.03 ResearchRansomware backup targeting statistics 2026The data on attackers going after backups, and who actually recovers.04 NewsRetail cyberattack lessons: TFG London, ASOS, H&MThe most recent cluster of UK incidents.

How our coverage of ransomware and cyber attacks in the UK divides up

Scroll the chart sideways to see all of it →

Counts are every published piece linked from this page. Each section does a different job, so read across them rather than down one.

All coverage

Everything we have published on ransomware and cyber attacks in the UK

Newest first. New news on this topic is added here automatically when it is published; the summary above is reviewed by hand and carries its own date.

Pieces published per month, by section

News 24Insights 5Learn 5Research 8

Scroll the chart sideways to see all of it →

Hover or tap a month for its breakdown. Every piece counted is listed below.

What the incident stories were about

One story each (4): Cloud data theft, Insider threat, Malware, Public sector.

Scroll the chart sideways to see all of it →

News stories in this topic, one tag each. “Exploited flaws” are attacks that began with a software vulnerability; those stories also sit in our exploited-vulnerabilities coverage.

What to do

Acting on it

Where Servnet can help, and the free tools that put numbers on it for your own estate.

Ransomware protectionIdentity, immutable backup and recovery testing, scoped for your estate.Open →Incident responseIf you think you are being attacked now.Open →Backup and DR sizing calculatorSize an immutable, 3-2-1-1-0 backup target.Open →Identity and access managementMost attacks in the data start with a compromised identity.Open →

Questions

Common questions

Is ransomware still rising in the UK?

It depends on what you count. Ransomware reports to the ICO peaked in 2023, and the government’s breaches survey put ransomware at 1% of UK businesses in 2025/26, down from 3%. But a joint CISA, FBI and NCA advisory puts SafePay at more than 600 critical infrastructure victims since August 2024, and UK-facing fashion retailers were hit by a cluster of incidents and claims in October 2026, though ransomware was not confirmed in any of the cases we covered.

Can UK organisations still pay a ransom?

Central government departments already may not pay ransoms, as a matter of policy. The government plans to extend a ban to public bodies and regulated critical national infrastructure and to require other organisations to notify before paying, but when we last checked, on 19 September 2026, no bill or timetable had been published. Paying can also breach existing financial sanctions law.

What protects best against ransomware?

The data we have covered points the same way: protect identities first, since 79% of attacks in Sophos’s dataset started with a compromised identity, then keep at least one backup copy immutable or offline with separate admin accounts, and prove you can restore it. Groups such as SafePay and Medusa delete shadow copies and backups before they encrypt.

More topics

Other running coverage

Exploited vulnerabilities and patch alerts68 pieces · newest 28 Oct 2026 Cloud outages and IT resilience19 pieces · newest 23 Oct 2026 All topicsWhat topic pages are, and how they differ from News, Insights, Learn and Research.

Topic pages summarise Servnet’s own published coverage for information only; they are not security, legal or financial advice. Facts and sources are in the linked pieces, which follow our editorial standards. Spotted something out of date? Tell us at webmaster@servnetuk.com.

Where things stand, as of 28 Oct 2026

Still unclear

Read these first

Everything we have published on ransomware and cyber attacks in the UK

October 2026 6

September 2026 10

August 2026 11

July 2026 12

March 2026 2

October 2025 1

Acting on it

Common questions

Is ransomware still rising in the UK?

Can UK organisations still pay a ransom?

What protects best against ransomware?

Other running coverage

Talk to a UK specialist