TFG London cyberattack disrupts Phase Eight, Hobbs and Whistles IT systems
The UK arm of South Africa's Foschini Group disclosed a cyberattack that took several IT systems offline across its Phase Eight, Hobbs and Whistles brands.
- Victim
- TFG London
Incidents in country:
United Kingdom
45 incidents catalogued
ASOS confirms data breach after hackers hijack app notifications
UK online fashion retailer ASOS confirmed that attackers used stolen employee credentials to access customer data via third-party platforms, after shoppers received hacker-controlled push notifications through its app.
- Victim
- ASOS
Dyfed-Powys Police cyberattack
Welsh police force Dyfed-Powys Police confirmed a cyber incident, identified on 14 September 2026, that disrupted non-emergency systems and may have exposed staff information; 999 and 101 services were unaffected.
- Victim
- Dyfed-Powys Police
Revolut confirms customer data breach through fake government data requests
British fintech Revolut disclosed that an unauthorized party used a legitimate government agency's email domain to submit fraudulent requests and obtain sensitive data on a limited number of customers, reportedly targeting high-net-worth users.
- Victim
- Revolut
Manchester Airports Group breach exposes 8.7 million customers
Manchester Airports Group disclosed a data security incident in which an unauthorized third party obtained personal details relating to around 8.7 million customers of car-park, lounge and in-airport Wi-Fi services across its Manchester, Stansted and East Midlands airports.
- Victim
- Manchester Airports Group (MAG)
- Records
- 8.7M
Suspected Iran-linked cyberattack shuts down a small UK power plant for four days
The UK government confirmed that a cyberattack knocked a small-scale energy generator offline for four days, in what was reported as the first disruptive Iranian-linked cyberattack of its kind in Britain, alongside attacks on U.S. water utilities.
- Victim
- Unnamed UK small-scale power generator
Fortune 500 Azure/Entra ID data theft (TheHatman)
A threat actor using the handle TheHatman advertised roughly 3.64 million employee directory records scraped from the Microsoft Azure and Entra ID tenants of multiple Fortune 500 companies, with access reportedly gained through stolen credentials harvested by infostealer malware.
- Victim
- Multiple Fortune 500 companies (Azure/Entra ID tenants)
- Records
- 3.6M
Beacon CRM data breach
Beacon, a CRM platform used by more than a thousand UK charities, confirmed that an attacker used an AWS access key exposed in the company's public JavaScript to copy and exfiltrate its entire customer database of supporter and donor records.
- Victim
- Beacon (Beacon CRM)
UK Department for Education helpdesk portal breach (ExfilSquad extortion)
The UK Department for Education confirmed that attackers stole around 607,000 records from its helpdesk self-service portal and Turing Scheme portal, after the extortion group ExfilSquad claimed the attack.
- Victim
- Department for Education (UK)
- Records
- 607.0K
Health-tech firm Craneware says customer, employee and partner data stolen in cyberattack
Edinburgh-based healthcare billing software maker Craneware disclosed that attackers gained unauthorised access to part of its data environment and exfiltrated a significant volume of employee, customer and partner records before being expelled.
- Victim
- Craneware
University of Nottingham student-records breach claimed by ShinyHunters (2026)
The University of Nottingham confirmed a cyber incident after the ShinyHunters extortion group claimed to have stolen around 40 GB of data from its student-records system, exposing roughly 455,000 email addresses along with names, passport numbers, and fee-payment details.
- Victim
- University of Nottingham
- Records
- 455.0K
Pro-Iran 313 Team DDoS knocks Ubuntu and Canonical web services offline, then demands contact
A sustained distributed denial-of-service attack claimed by the pro-Iran hacktivist group 313 Team took down ubuntu.com, canonical.com and several Ubuntu security and archive services, after which the group tried to turn the outage into an extortion attempt.
- Victim
- Canonical (Ubuntu)
UK Biobank data on 500,000 volunteers listed for sale on Alibaba
The UK government disclosed that de-identified health data from UK Biobank, covering all 500,000 participants in at least one dataset, had been offered for sale on Alibaba's e-commerce platforms after academic institutions with legitimate research access breached their contracts.
- Victim
- UK Biobank
Jaguar Land Rover global production halt (Scattered Lapsus$ Hunters, 2025)
A cyberattack on Britain's biggest carmaker forced JLR to shut down its global IT network and halted vehicle production in the UK, China, Slovakia, India, and Brazil for five weeks — now considered the most economically damaging cyber incident in UK history.
- Victim
- Jaguar Land Rover
- Loss
- $2.40B
Marks & Spencer DragonForce ransomware (Scattered Spider, 2025)
Social-engineering of a third-party service desk gave Scattered Spider a domain administrator, which they used to deploy DragonForce ransomware on M&S's VMware ESXi estate at Easter 2025 — knocking out contactless payments, Click & Collect, and online ordering for over six weeks.
- Victim
- Marks & Spencer
- Loss
- $550.0M
National Public Data SSN breach
A breach of data broker National Public Data (Jerico Pictures) exposed a database of roughly 2.9 billion records containing names, Social Security numbers, dates of birth, and addresses scraped from public and non-public sources, triggering a wave of lawsuits and the company's bankruptcy.
- Victim
- National Public Data (Jerico Pictures, Inc.)
- Records
- 2.90B
Central Tickets data breach (2024)
In September 2024, data from the ticketing service Central Tickets was publicly posted to a hacking forum. The data suggests the breach occurred several months earlier and exposed 723k unique email addresses alongside names, phone numbers, IP addresses, purchases and passwords stored as unsalted…
- Victim
- Central Tickets
- Records
- 722.9K
England Cricket data breach (2024)
In March 2024, English Cricket's icoachcricket website suffered a data breach that exposed over 40k records. The data included email addresses and passwords stored as either bcrypt hashes, salted MD5 hashes or both.
- Victim
- England Cricket
- Records
- 43.3K
British Library Rhysida ransomware (2023)
Rhysida ransomware operators destroyed servers, demanded ~£600,000, and leaked 600 GB of internal data when the British Library refused to pay. The main catalogue did not return online — read-only — until January 2024. Recovery is consuming 40% of the Library's financial reserves.
- Victim
- British Library
- Loss
- $8.5M
UK Electoral Commission data breach
Chinese state-linked hackers exploited unpatched Microsoft Exchange ProxyShell flaws to dwell undetected in the UK Electoral Commission's systems for over a year, accessing electoral-register data on roughly 40 million voters.
- Victim
- UK Electoral Commission
- Records
- 40.0M
Rightbiz data breach (2023)
In June 2023, data belonging to the "UK's No.1 Business Marketplace" Rightbiz appeared on a popular hacking forum. Comprising of more than 18M rows of data, the breach included 65k unique email addresses along with names, phone numbers and physical address.
- Victim
- Rightbiz
- Records
- 65.4K
MOVEit Transfer mass exploitation (Cl0p)
Cl0p exploited CVE-2023-34362 in Progress Software's MOVEit Transfer to mass-extort over 2,700 organizations, including the BBC, British Airways, and the U.S. Department of Energy.
- Victim
- Progress Software MOVEit Transfer (2,700+ downstream)
- Loss
- $12.15B
- Records
- 95.0M
Capita ransomware attack
A Black Basta ransomware intrusion into UK outsourcing giant Capita exposed pension and personal data on roughly 6.6 million people, drew a £14 million ICO fine, and cost the company over £25 million.
- Victim
- Capita
- Loss
- $32.0M
- Records
- 6.6M
Planet Ice data breach (2023)
In January 2023, the UK-based ice skating rink booking service Planet Ice suffered a data breach. The incident exposed the personal data of 240k people including email and physical addresses, phone numbers, genders, dates of birth and passwords stored as MD5 hashes.
- Victim
- Planet Ice
- Records
- 240.5K
More incidents (21)
- Royal Mail LockBit ransomware
- Advanced / NHS 111 ransomware attack
- Fanpass data breach (2022)
- Fantasy Football Hub data breach (2021)
- Guntrader data breach (2021)
- Kaseya VSA supply-chain ransomware (REvil)
- Facebook 533M scraped records leak
- NurseryCam data breach (2021)
- People's Energy data breach (2020)
- Travelex Sodinokibi ransomware and collapse (2019–2020)
- British Airways Magecart card-skimming
- Fashion Nexus data breach (2018)
- Facebook–Cambridge Analytica data scandal
- Equifax data breach
- NotPetya destructive wiper
- WannaCry ransomware worm
- VTech children's data breach
- TalkTalk customer data breach
- Muslim Directory data breach (2014)
- Badoo data breach (2013)
- Last.fm data breach (2012)