UK businesses are being urged to revert to pen and paper, and develop written contingency plans that can operate without computer systems, as the National Cyber Security Centre (NCSC) reports a record 204 “nationally significant” cyber incidents in the past year—more than double the 89 recorded the previous year.
Richard Horne, CEO of the NCSC, emphasised the critical need for organisations to “develop a strategy for maintaining operations without their IT, and to swiftly restore that IT, should an attack penetrate their defences”. The guidance comes as high-profile attacks on major British companies have demonstrated the severe operational disruption that can result from cyber intrusions.
Major Supply Chain Disruptions Drive Policy Response
The NCSC’s warning follows devastating attacks on several prominent UK businesses throughout 2024 and early 2025. Marks & Spencer suffered estimated losses of £300 million after hackers gained access through a third-party contractor, disrupting online orders and exposing customer data. The Co-op faced similar disruption with approximately £206 million in underlying margin impact.
Most notably, a ransomware attack on Jaguar Land Rover in August 2025 forced the company to shut down all UK production facilities for nearly a month, with daily revenue losses reportedly reaching £72 million. The attack had cascading effects throughout the automotive supply chain, threatening approximately 200,000 jobs and forcing the UK government to provide a £1.5 billion loan guarantee to stabilise the sector.
Resilience Engineering
The NCSC is promoting a methodology called “resilience engineering,” which focuses on creating systems that can anticipate, absorb, recover from, and adapt to cyber threats. This approach extends beyond traditional cybersecurity measures to encompass broader operational continuity.
The agency specifically recommends that contingency plans be documented on paper or stored offline, acknowledging that digital systems may be completely inaccessible during an attack. This represents a significant shift toward analog backup processes for critical business functions.
The scale of the threat has prompted unprecedented government intervention. Ministers, the NCSC, and the National Crime Agency have written directly to chief executives and chairs of all FTSE 350 companies, warning of the “growing intensity, frequency and sophistication of hostile cyber activity”.
The letter outlines three specific actions all organisations should implement:
- Adopting the government’s Cyber Governance Code of Practice
- Signing up to the NCSC’s free early warning service
- Ensuring compliance with Cyber Essentials standard across entire supply chains
Security Minister Dan Jarvis addressed business leaders at the NCSC’s annual review launch, calling for “urgent collective response” to mounting cyber threats.
Record-Breaking Attack Statistics
The NCSC dealt with 429 cyber incidents requiring support in the year ending August 2025, with nearly half classified as nationally significant. Among these, 18 incidents were categorised as “highly significant” due to their serious impact on central government, essential services, or the UK economy—a 50% increase from the previous year.
“On average, the NCSC has dealt with four nationally significant incidents a week,” Horne stated. “That is a 50% increase on the previous year and a marked increase for the third consecutive year”.
The attacks span multiple threat vectors, with three known Microsoft SharePoint vulnerabilities alone accounting for 29 incidents managed by the NCSC. Ransomware remains the most acute threat, while phishing affects 84% of businesses experiencing breaches.
The NCSC identified several state and non-state actors driving the increase in sophisticated attacks. China has been highlighted as the dominant cybersecurity threat, with one China-linked company exposed for operating a botnet of 260,000 computers. Russia’s invasion of Ukraine and the Israel-Gaza conflict have inspired hacktivist groups targeting UK infrastructure.
Iran-linked hacking groups are known to target UK critical infrastructure, while North Korean IT workers are “almost certainly” infiltrating UK organisations by posing as freelance staff from other countries.
