The CMC estimated in June that the financial impact of the attacks on the two retailers was between £270 million and £440 million.
The investigation into the JLR attack is being led by the National Crime Agency but few details have emerged on who was behind the incident. The CMC estimate did not include assumptions about whether JLR had paid a ransom or not.
Martin said companies tended to focus their resources on protecting themselves against data breaches since they have a legal obligation to protect customer data.
But cases like JLR underscore the increasing risks of attackers not just stealing data but destroying critical networks supporting a company’s operations, and the high costs associated with such attacks.
While state actors have not been behind recent attacks on M&S and other retailers, Martin warned that there was an increasing “geopolitical vulnerability” and risk that hostile nation states could attack UK businesses for non-financial reasons.
“It is now clear not just that criminal disruptive attacks are the worst problem in cyber security right now, but they’re a playbook to hostile nation states on how to attack us,” Martin said at a separate speech in London on Wednesday. “So cyber security has become economic security. And economic security is national security.”
Last week, the UK National Cyber Security Centre also warned that state actors continued to pose “a significant threat” to Britain and global cyber security, citing the risks posed by China, Russia and others.
According to an annual review by NCSC, the UK had suffered 204 “nationally significant [cyber] incidents” in the 12 months to August 2025, compared with 89 in the same period a year earlier.
The term is used to describe the three most serious types of incidents as defined by UK law enforcement.
© 2025 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.
