The Reality of State-Sponsored Cyberattacks

State-sponsored cyberattacks are no longer distant threats playing out on international news. They strike at the heart of the UK's critical infrastructure and business sector, targeting the very systems that uphold daily life. Recent events, such as the pro-Russian attacks on Norwegian hydroelectric dams, are stark reminders of how politics and cyber warfare are now indelibly linked.

For UK businesses, the risks are not just about direct attacks but about the domino effect these incidents can trigger across supply chains, partners, and even customers.

Recent Attacks: A Wake-Up Call

Attacks on critical infrastructure have surged in both frequency and impact, confirming warnings from British intelligence. The UK has seen a threefold rise in serious cyber incidents between 2023 and 2024 alone.

High-profile examples include:

• Legal Aid Agency Breach: Exposed data of more than two million people, including criminal records and financial information spanning fifteen years. The risks of fraud and extortion from such breaches are profound.
• Retail Ransomware Attacks: Marks & Spencer, Co-op, and Harrods were all hit in 2025, disrupting operations and damaging customer trust. A single ransomware campaign affected multiple retailers through shared suppliers and IT partners.
• Attacks on Education: Spear-phishing campaigns targeted Scottish schools during examination season, cutting off thousands of students from essential digital resources.

These incidents emphasise that hostile actors are broadening their focus to every sector that can cause maximum disruption and grab the largest “splash", from utilities and transport, to retail and education.

Why UK Firms Cannot Ignore the Risk

With cyberattacks costing UK businesses over $55 billion in the last five years, the economic threat matches the potential to disrupt society. Large-scale events are no longer rare, and supply chains often multiply the impact.

Critical National Infrastructure (CNI) providers are especially vulnerable:

• Over 40% of CNI organisations have suffered a data breach in the past year.
• 93% report an increase in attack frequency and sophistication.
• Many businesses lag behind on core security basics, often lacking even proper antivirus or firewalls.

All this is compounded by the fact that planned UK government legislation to strengthen cyber resilience has been delayed, leaving many organisations without clear mandatory security requirements.

Key Lessons for Every UK Business

1. Supply Chain Is Now a Primary Attack Route

Modern attacks do not always aim at their true targets directly. Attackers frequently use suppliers, contractors, cloud vendors, or other third parties as “stepping stones”. This is why even businesses that are not themselves critical infrastructure must now assume that they can be targeted as an indirect route into more valuable organisations.

Action Point: Every business should map its critical suppliers and require evidence of robust cybersecurity controls during procurement and review cycles. Ask about their patch and vulnerability management as well as their incident response and recovery processes.

2. Threat Intelligence: Know Who Might Target You

State-sponsored actors have clear motivations and ‘shopping lists’, disrupting national infrastructure, harvesting sensitive data, or sowing social distrust. They are persistent and patient, often probing defences for months before launching an attack.

Action Point: Implement robust threat intelligence, either in-house or through a specialist partner, to understand which Advanced Persistent Threat (APT) groups are likely to target your sector. Tailor your monitoring and defence accordingly.

3. Regular Penetration Testing and Purple Teaming

Frequent pentesting is essential to uncover the real vulnerabilities across internet-facing systems and cloud infrastructure. However, adversaries do not restrict themselves to periodic checks, they look for weaknesses all year round.

Action Point: Consider both manual and AI-driven penetration testing for efficiency and depth. Purple teaming (blending red and blue team tactics) enables you to simulate real-world advanced adversaries and test detection and response together.

Learn more about purple teaming and how it can bridge gaps in your defences on our purple teaming page.

4. Rapid Response Is Essential

Attackers aim to move from initial compromise to data exfiltration or operational disruption quickly. The difference between a contained incident and a crisis frequently comes down to how fast you detect and contain the breach.

Action Point: Develop a clear, rehearsed incident response plan covering both the technical containment and public communications. Regularly review your cyber insurance and recovery arrangements.

Explore how EJN Labs supports businesses with incident preparedness and response on our about us page.

5. Invest in Updating Legacy Technology

Legacy IT systems and operational technology remain primary targets because they are harder to patch and defend. State-sponsored actors understand these weaknesses and often target them specifically.

Action Point: Prioritise investment to replace, upgrade, or isolate legacy assets. Patch regularly and ensure unsupported applications are either retired or robustly segregated.

6. Board-Level Engagement Is Now Necessary

Cybersecurity is no longer the preserve of IT departments; it is a boardroom issue that can determine business survival and reputation.

Action Point: Educate company leadership about the real risks and costs of major cyberattacks and ensure cyber risk forms part of standard risk and resilience discussions.

The Road Ahead: Resilience Through Preparation

With incoming legislation on cyber resilience and ever-increasing attack sophistication, organisations must shift from awareness to action. Addressing legacy weaknesses, fortifying supply chains, and building strong incident response capabilities are now essential.

• Audit your supply chains for cyber risk.
• Make threat intelligence and continuous monitoring routine.
• Test your defences, do not assume they are sufficient.
• Train your staff, phishing and social engineering remain favourite tactics of both criminal and state actors.
• Establish a clear incident response process.

EJN Labs is dedicated to helping British businesses protect themselves against both known and emerging threats. From penetration testing to supply chain risk assessments, our services help businesses build cyber resilience for today’s world.

To learn more, see our AI penetration testing and red teaming capabilities, or talk to us about your unique risks.

Stay Prepared: Practical Next Steps

• Evaluate supplier security now: Do not wait for regulators to mandate action.
• Test incident scenarios: Run simulated attacks to test your processes under pressure.
• Invest in continuous improvement: Cyber threats will not slow down, neither should your defences.

The challenge is significant. But with the right approach, UK businesses can not only defend their operations but also strengthen their position as trusted partners in an interconnected digital economy.

For bespoke guidance or to discuss how EJN Labs can help, contact us any time or learn more at ejnlabs.com.