Major UK Cyber Incidents – June 2025

HMRC Phishing Scam – £47 Million Hit

A sophisticated phishing campaign targeted 100,000 UK taxpayer PAYE accounts, extracting £47 million in fraudulent payouts. Though HMRC’s systems weren’t compromised, the attackers used stolen data from other breaches—a classic credential phishing tactic—and relied heavily on social engineering. Victims were protected, but the attack highlights the grip phishing holds on public trust.

H&M Outage – Suspicious System Failure

On the 4th June, H&M UK faced a widespread payment system outage, halting in-store sales nationwide for a few hours. While not officially declared a cyberattack, the timing and similarity to other retailer incidents raise red flags that this may have been a Distributed Denial of Service (DDoS) or supply chain disruption.

Glasgow City Council – Third-party Breach

On the 19th June, Scotland’s largest council detected malicious activity in a third-party hosted environment, forcing the isolation of servers serving 625,000 residents. Planning applications, parking, and waste services went offline. While no financial data was affected, reliance on third-party infrastructure without immutable backups left core services vulnerable.

MOVEit-Related UK Incidents

The MOVEit vulnerability, actively exploited in June, ensnared multiple UK organisations—including the BBC, Boots, British Airways, and Ofcom. Attackers used the flaw to exfiltrate personal and confidential data before being held to ransom. Though this started in 2023, renewed waves hit in early June, notably affecting Ernst & Young and Transport for London (TfL).

Root Causes & Attack Patterns

Phishing & Credential Stuffing: HMRC’s losses and MOVEit steals relied on found credentials and deceptive emails—improving MFA and credential hygiene is essential.

Third-party vulnerabilities: Glasgow and MOVEit incidents show a consistent thread: trusting external vendors without assurance invites risk.

Service disruption tactics: Whether DDoS or software failure, outages like H&M’s erode customer confidence and hurt operations.

Lack of immutable backups and resilience: Glasgow’s incident emphasised the need for safeguarded backups and tested continuity plans.

Why This Matters to Your Business

• Any organisation is at risk, public bodies, retailers, and critical services alike.
• Downtime damages reputation and revenue: even hours-long outages can erode client trust.
• Regulators are watching as new laws (eg. Data Use & Access Act) increase reporting obligations and scrutiny.
• Attackers have become adaptive: combining phishing, software exploits, and supply-chain vectors into coordinated strikes.