By Davide Baptiste
The Warning Becomes Real
In a previous article on this subject, it was argued that any confrontation with Iran would be felt in Scotland not through missile strikes, but through frozen tills, locked-up systems and broken supply chains. Sadly, that warning is no longer theoretical. Pro-Iranian hacktivist personas such as Handala have claimed destructive attacks on major medical and payment providers, while closer to home, Scottish organisations continue to grapple with ransomware, data breaches and growing legal and regulatory fallout.
The emerging picture is clear: Scottish businesses now operate in a threat environment where international conflict and local cyber resilience are tightly intertwined.
A Global Threat Meets Local Incidents
Iran-linked actors have shifted from quiet espionage to high-impact disruption: wiping devices, stealing vast datasets and sabotaging hospitals and payment networks that underpin everyday life. At the same time, Scottish cases show we are already struggling with “ordinary”, seemingly “everyday”, cybercrime.
NHS Dumfries and Galloway, for example, suffered a focused ransomware attack and subsequent leak of confidential patient data, prompting a multi-agency response and months of recovery work. The Scottish Cyber Activity reporting shows that, in recent years, public-sector incidents have spanned denial-of-service, account compromise and major ransomware campaigns, with ransomware now the single most prevalent threat type.
Legacy breaches continue to bite. Around 15,000 motorists are now cleared to pursue compensation against Glasgow-based Arnold Clark over a previous cyber incident that saw customer data appear on the dark web. Police Scotland has been fined for mishandling sensitive victim information, underlining that even well-resourced public bodies can fall short on information governance.
These are not Iran-linked campaigns – but they show just how exposed we already are. Layer a motivated state-aligned actor on top of that baseline, and the risk to Scottish business becomes stark.
Scotland’s Expanding Attack Surface
Recent analysis during Cyber Scotland Week stressed that AI-enabled threats are growing in speed and sophistication and that Scottish SMEs, in particular, remain under-prepared. Many owners say cyber risk worries them, yet a significant minority still believe they are too small to be targeted or adequately protected by default tools.
Oversight bodies are sending the opposite message. The report on the cyber-attack against Comhairle nan Eilean Siar described “immediate, severe and prolonged disruption”, including near-total loss of data on council servers, and warned that all councils must assume it is a case of “when, not if”. Scottish incident data records a steady drumbeat of attacks across local authorities, health, central government, education and the private suppliers that support them.
In other words, Scotland is already a live hunting ground for cybercriminals. In the context of rising tensions with Iran, that same exposed infrastructure and fragmented readiness becomes an attractive target surface for politically motivated actors as well.
Connecting the Dots Back to Iran
When Iranian-aligned personas hit med-tech firms and payment processors, they are deliberately choosing nodes that sit at the junction of politics and daily life. The same kinds of suppliers sit in the middle of Scottish healthcare, retail, tourism and manufacturing.
The lesson for Scottish leaders is not to obsess over whether a given attack is “officially” Iranian or criminal. What matters is that:
- The techniques are similar: ransomware, wipers, phishing, exploitation of known vulnerabilities.
- The choke points are the same: global SaaS platforms, industrial controls, logistics and payment rails.
- The impact is indistinguishable for a Scottish business: downtime, lost data, legal exposure and reputational harm.
Whether the ransom note comes from a teenage gang or a state-directed proxy, the only meaningful defence is better cyber hygiene and resilience.
Raising the Bar After the First Warning
In my earlier piece, I urged Scottish boards to treat Iran-linked cyber risk as a core continuity issue. The last few months of Scottish incidents and global escalation mean those recommendations now need to be treated as minimum standards.
Every serious Scottish organisation should be able to answer yes to five questions:
- Do we have multi-factor authentication on email, VPNs and admin accounts as standard?
- Are our internet-facing systems patched promptly, and are unused remote-access routes closed?
- Have we identified our truly critical suppliers – payments, cloud, med-tech, logistics – and asked how they are responding to heightened nation-state threats?
- Do we maintain recent, tested, offline or immutable backups that would let us recover from a full ransomware or wiper event?
- Are our staff regularly trained and tested against realistic phishing and conflict-themed lures, with a simple, non-punitive way to report concerns?
If the answer to any of these is no, then the gap between the warning in the first article and the reality we now face is your risk to own.
The Decision Point for Scottish Business
Scotland’s latest cyber activity data shows a regular flow of attacks across public services and their suppliers, even before we factor in potential Iran-linked escalation. The emergence of destructive, politically motivated operations abroad is not a side story; it is a preview of what could play out here.
The choice for Scottish boards and owners is straightforward. You can treat the growing overlap between geopolitics and cybercrime as background noise, or you can read it for what it is: a final reminder that resilience, not luck, will decide which Scottish businesses withstand the next wave.
