United Kingdom

This page covers cyber threats to the United Kingdom. It brings together official UK texts (the National Cyber Security Centre, the National Crime Agency, the Information Commissioner’s Office, the Foreign Office, the Home Office and legislation.gov.uk), and Brandefense research. Where an official source names the UK as a target, the page says who said it and when.

Threat groups that official sources link to the United Kingdom

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT29: the NCSC advisory of 16 July 2020 says APT29 targeted organizations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom. The NCSC and Canada’s CSE assessed that APT29 is almost certainly part of the Russian intelligence services. The Foreign Secretary called out the attacks the same day.

APT28: on 18 July 2025 the NCSC said APT 28 was responsible for deploying a malware it calls AUTHENTIC ANTICS, and the UK sanctioned three GRU units. The UK government release of that date says the units ran a sustained malicious campaign over many years, including in the UK, and that in the UK Russia has targeted media outlets, telecoms providers, political and democratic institutions, and energy infrastructure. A GOV.UK profile of GRU cyber operations, updated 13 July 2026, links APT28 to GRU Unit 26165 and says it attempted intrusions into the Foreign, Commonwealth and Development Office in March 2018.

Sandworm: the same GOV.UK profile (updated 13 July 2026) says GRU Unit 74455, also known as APT44 or Sandworm, attempted cyber intrusion operations against the Foreign, Commonwealth and Development Office in March 2018 and the UK’s Defense, Science and Technology Laboratory in April 2018, together with Unit 26165.

Lazarus Group: on 19 December 2017 the Foreign Office Minister attributed the WannaCry ransomware incident to North Korean actors known as the Lazarus Group. The NCSC assessed this as highly likely. The release says WannaCry hit 300,000 computers in 150 countries, including 48 NHS trusts. The NHS incident page gives the National Audit Office figures, which differ.

LockBit: the National Crime Agency (NCA) led an international disruption of LockBit, which it revealed on 20 February 2024. The NCA says LockBit attacks targeted thousands of victims around the world, including in the UK, and that it would contact UK-based victims to offer help. On 7 May 2024 the UK, US and Australia sanctioned its administrator, Dmitry Khoroshev.

Two more actors named by UK bodies do not yet have a profile here. On 25 March 2024 the UK said it was almost certain that the China state-affiliated group APT31 carried out reconnaissance against UK parliamentarians in 2021. The same release says the NCSC assesses that the Electoral Commission’s systems were highly likely compromised by a Chinese state-affiliated entity between 2021 and 2022. The NCSC Annual Review 2025 also says that in September 2024 the NCSC and allies exposed a covert network run by a China-linked company called Integrity Technology Group.

Incidents on record

The incidents listed below are the major ones that UK government bodies, regulators or the organizations themselves reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What the NCSC reports

The NCSC Annual Review 2025 covers 1 September 2024 to 31 August 2025 and was published on 14 October 2025. The NCSC triaged 1,727 incident tips into 429 incidents that needed its incident team. Nationally significant incidents were 48% (204) of that total, up from 89 the year before, and 4% (18) were highly significant. The NCSC says that is an average of four nationally significant attacks a week. It also says its data is not a true reflection of all incidents, because reporting a breach is often not mandatory.

The NCSC says the top sectors reporting ransomware to it were academia, finance, engineering, retail, health and manufacturing, and that no sector is exempt. On state threats, it calls China a highly sophisticated and capable threat actor that targets a wide range of sectors, including the UK. It says Russia’s most disruptive activity stays focused on Ukraine, that the Iranian threat highly likely extends to UK entities, and that UK firms are almost certainly targeted by IT workers from North Korea.

On crime, the NCSC calls ransomware one of the most acute and pervasive threats to UK organizations and points to the attacks on Marks & Spencer, the Co-op and others in retail. It adds that most cyber criminals are sector agnostic. The NCA goes further: it says ransomware remains the greatest cyber serious and organized crime threat to the UK, and that Russian-language criminals running ransomware as a service are responsible for most high profile cybercrime attacks against the UK.

How attackers target the United Kingdom: Brandefense research

Our own research has covered the United Kingdom many times. In summary, as our posts report:

The national picture: our United Kingdom threat landscape report for 2025 says attackers are expanding across dark web activity, financial fraud, ransomware and exploited vulnerabilities. It reports infostealer credential leaks affecting telecommunications, energy and utilities, government, manufacturing, healthcare and e-commerce, a sharp rise in stolen credit card detections between 2024 and 2025, and ransomware most often confirmed against manufacturing and business services. It names LockBit3, RansomHub and BlackBasta among the dominant groups and says threat actors are moving from opportunistic to systematic, multi-sector campaigns.

Ransomware and extortion: the DragonForce profile links the group to the 2025 disruption at UK retailers Harrods, Marks & Spencer and Co-op and says its recent activity leans strongly toward UK retail. The Scattered Spider profile says the NCA reported on 16 July 2026 that its action against two leading members effectively halted the group. The Q2 2026 ransomware review lists the United Kingdom among the main geographic targets of two of its top groups.

The Cactus analysis says its targets are large organizations in the United States, the United Kingdom and parts of Europe, the Medusa analysis lists the United Kingdom among six countries where the group buys access, and the AvosLocker research summary lists it among targeted countries. Our 2025 ransomware review names the UK, with the US and Canada, as a primary target. The LockBit leader post covers the NCA takeover of LockBit services in February 2024 and the sanctions of 7 May 2024. The critical infrastructure post covers the National Audit Office findings on how WannaCry hit NHS trusts in England; the NHS incident page gives the official figures.

State-linked activity: the APT33 analysis, the Mythic Leopard profile, the Ocean Lotus profile and the Equation Group profile each list the United Kingdom among targeted countries. The Lazarus profile says WannaCry hit the NHS in Britain and was attributed by the US Department of Justice and British authorities. Our hybrid warfare analysis notes that the NCSC warned large UK organizations to strengthen resilience as tensions over Ukraine grew in early 2022.

Fraud and stolen data: our initial access post says the Emotet trojan was spread in UK campaigns as attachments themed as fake phone bills, and a reported WhatsApp data sale listed over 11 million UK users among those affected.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand. Brandefense works in the UK through a partner: on 31 July 2024 it announced a strategic partnership with Northamber, a UK distributor of IT and cyber security products (see our press room and partner webinar).

Law and national strategy

The National Cyber Strategy 2022 was published on 15 December 2021. It is built on five pillars, from strengthening the UK cyber ecosystem to detecting, disrupting and deterring adversaries. Its stated outcomes run to 2025. On 6 January 2026 the Department for Science, Innovation and Technology published the Government Cyber Action Plan, which sets out how government will improve the cyber security and resilience of public services. It describes a new Government Cyber Unit backed by over 210 million pounds of central investment, and says legacy systems often cannot be defended by modern cyber security measures.

The Network and Information Systems (NIS) Regulations 2018 require an operator of essential services to notify its competent authority of an incident with a significant impact, no later than 72 hours after becoming aware of it. The Cyber Security and Resilience (Network and Information Systems) Bill proposes new laws to improve UK cyber defenses and protect essential public services. The government page opened records that it was introduced to Parliament on 12 November 2025. In April 2025 the government said that data centers, managed service providers and critical suppliers would need to meet cyber security requirements, with about 1,000 service providers in scope. The NCSC says that, if enacted, more organizations such as managed service providers would come into scope of the NIS Regulations. We did not find a later stage recorded on the government pages we opened.

On ransomware, the Home Office consulted on three proposals: a targeted ban on ransomware payments for public sector bodies and regulated critical national infrastructure, a payment prevention regime and mandatory incident reporting. In its response of 22 July 2025, nearly three quarters (72%) of respondents agreed with the targeted ban. On 24 October 2025 the Home Office said that under the new plans public sector bodies, including the NHS, local councils and schools, and operators of critical national infrastructure would be banned from paying ransom demands.

How incident response is organized

The NCSC is a part of GCHQ and was formed by combining separate parts of government, MI5 and GCHQ. It works closely with international allies, law enforcement and the UK intelligence and security agencies. Its incident team treats reports in confidence, and the NCSC encourages affected organizations to report incidents to their regulators. The UK government categorizes cyber attacks, and the top three categories (national cyber emergency, highly significant and significant incidents) are the nationally significant ones. The NCA leads the law enforcement response, as in its LockBit operation.

Inside government, the Government Cyber Coordination Centre (GC3), part of the Government Cyber Unit and jointly sponsored with the NCSC, coordinates the cross-government response to cyber threats, vulnerabilities and incidents. For essential services, the NCSC Cyber Assessment Framework is guidance for organizations that play a vital role in the day-to-day life of the UK.

Sectors and rating

The NCSC says data centers have been designated as critical national infrastructure. In finance, it reports that a multi-year NCSC and Bank of England project to embed cyber security into the renewed banking system has concluded. We found no national rating figure in the official texts we opened.

Personal data

The UK GDPR sets a duty on all organizations to report certain personal data breaches to the supervisory authority, the Information Commissioner’s Office, within 72 hours of becoming aware of the breach, where feasible. The ICO guide also says the Data (Use and Access) Act changes the reporting timescale for breach reports under the Privacy and Electronic Communications Regulations from 24 hours to 72 hours.

The official counts on this page come from the NCSC and cover only incidents reported to it. Figures for the United Kingdom will come from Brandefense Atlas.