UK Hackers: Young, English-Speaking, and Dangerous

In April 2025, a cyber attack on Marks and Spencer caused significant disruption, costing the FTSE 100 company £131 million. The perpetrators, a collective known as Scattered Spider, represent a shift in cybercriminal profiles. These new actors are often young, English-speaking, and motivated by enhancing their standing within hacker communities rather than solely financial gain. This pattern has been observed in attacks on Transport for London (TfL) and UK retailers Harrods and Co-Op, leading experts to re-evaluate the typical threat actor.

While Russian-speaking ransomware groups and West African business email compromise schemes remain significant threats, a growing number of Western teenagers and young adults are engaging in sophisticated cybercrime. Groups like ShinyHunters and Hellcat, distinct from traditional Russian organized crime, are actively leaking data and deploying ransomware. This influx of less predictable operators has complicated incident outcomes, as noted in a report by S-RM which tracked 67 distinct ransomware groups in 2025.

Despite these headline-grabbing attacks by newer actors, established groups continue their operations with tried-and-tested methods. The rapid advancement of artificial intelligence has also lowered the technical barrier for aspiring hackers, enabling more sophisticated deception tactics, including AI-powered fake calls and deepfake videos. Research indicates that 76 percent of organizations have experienced security incidents involving AI applications in the past two years.

In response to the evolving threat landscape, UK authorities have issued stark warnings. The NCSC's CEO emphasized that CEOs failing to prepare for cyber attacks are jeopardizing their business futures. A joint letter from four ministers urged business leaders to bolster their defenses, highlighting that preparedness and rehearsed recovery plans are crucial for resilience in an increasingly hostile digital environment.