Anatomy of a Breach: 2025 Year in Review — M&S Hits UK GDP, Bybit Loses $1.4 Billion, and 16 Billion Credentials Prove Passwords Are Dead

2025: M&S hits UK GDP. Bybit loses $1.4B. Passwords are dead. The UK's worst year for cybersecurity.

2025 was the most devastating year for UK corporate cybersecurity on record. Marks & Spencer's £1.9 billion DragonForce ransomware attack impacted UK GDP growth — the first time a single corporate breach demonstrably affected national economic output. Co-op and Harrods were targeted in the same coordinated campaign, prompting emergency NCSC guidance. Jaguar Land Rover's manufacturing was halted during peak registration season. And Collins Aerospace ransomware disrupted Heathrow and other European airports.

Globally, Bybit lost $1.4 billion in the largest cryptocurrency theft ever. Three Chinese APT groups exploited a SharePoint zero-day to compromise 400+ organisations including US nuclear security. The Salesforce ecosystem breach was dubbed the 'SolarWinds moment for SaaS.' And 16 billion stolen credentials were discovered — proving conclusively that password-only authentication has failed. Seventeen years of this series. As the BBC reported on M&S and the NCSC issued emergency retail guidance, the root causes remain unchanged. The consequences have never been higher.

Twelve months. The UK's worst year. The world's largest thefts.

204 articles. 2009 to 2025. The UK's worst year demands the strongest response.

With 204 articles across seventeen years, the Anatomy of a Breach series has documented the complete arc from HMRC's lost CDs to Marks & Spencer's £1.9 billion catastrophe. The root causes have not changed in seventeen years: unpatched systems, absent MFA, social engineering, supply chain trust, and the persistent gap between policy and implementation. But 2025 proved that the consequences have reached a new level — impacting UK GDP, halting manufacturing at Britain's largest car maker, and disrupting major airports. The controls remain the same. The urgency has never been greater.

Penetration testing. Cyber Essentials certification. Social engineering testing. SOC in a Box monitoring. Incident response capability. Seventeen years of evidence. 204 articles. One conclusion. Implement these controls. The organisations that do survive. The rest fill these pages. The series continues into 2026.

Related Articles