Listening to M&S and the Co-Op give evidence about their recent attacks to the Business and Trade Sub-Committee on Economic Security, Arms and Export Controls on Tuesday 8 July 2025 brings home a sharp reality: cyber attacks aren’t theoretical. They are real, messy, human, and they affect every part of a business, from the front counter to the boardroom.  

Below, we’ve summarised the key learnings from their experience. And if you’re wondering where to start with building your own cyber resilience, our Cyber Resilience for Senior Leaders training is a practical first step to help you lead with confidence before a crisis hits. 

When the alarm goes off 

The Co-op described how on April 25th, within minutes of suspicious activity, their systems flagged an alert, and within an hour, their teams were working to contain the threat. M&S described it as “like an out-of-body experience,” saying, “the cyber team had no sleep or three hours a night… it’s not an overstatement to describe it as traumatic.” 

What was clear from their evidence was that if they had not prepared as they did, the reality of the outcome could have been so much worse. Both organisations had invested heavily, run simulations, and taken cyber security seriously. The Co-op’s investment in layered defences and clear crisis plans meant that, while containment was disruptive, it prevented ransomware from deploying, and their payment systems and customer-facing services remained operational.  

M&S, despite system shutdowns and recovery challenges, was able to continue trading in stores, keeping customers supplied while they worked through the chaos behind the scenes.  

The damage happens before the ransom note

M&S put it bluntly,

“by the time the threat actor makes themselves evident, your systems are already compromised.”

The damage, in many respects, was done before the ransom note arrived. 

For the Co-op, the attack was detected early enough to prevent ransomware deployment, but stopping the spread came at a cost. They had to lock down systems quickly, cutting off remote access and moving to manual workarounds in their distribution centres. They pointed out that “the actions we took to avoid more significant disruption were controlled and proactive, but they did have a significant impact for a short period of time on some parts of our operations.” 

Containment means choosing safety over efficiency 

This is a reality for any organisation. Containment and control may mean shutting down systems yourself, forcing you to trade efficiency for safety. The Co-op’s approach to “controlled amputation,” as the analogy was put to them, protected their wider operations. But it also meant two weeks of using manual systems for core processes while teams worked around the clock to rebuild. 

M&S highlighted how the complexity of legacy systems made their response more challenging. They noted that “legacy systems make it harder to compartmentalise your system,” and acknowledged that, despite strong preparation, recovery would take time. “Whatever you do, you are going to have to rebuild, and it is going to take a long time to come back.” They were clear: even when systems come back online, the rebuild phase is slow, careful, and not something that can be rushed if you want to do it securely.

The Co-op highlighted that

“one of the biggest vulnerabilities is around legacy systems that may no longer be patched.”

This is a reminder to know where your critical systems are, what condition they’re in, and to plan for how you would handle an attack if it happened tomorrow. 

The role of scenario planning.  

Both organisations had run simulations and crisis exercises before the attack, which helped them move quickly, make decisions under pressure, and coordinate with authorities. The Co-op described how these exercises were valuable in preparing teams for decision-making under pressure, skills that are invaluable when the real pressure hits, even though “there are always lessons to be learned from a real experience versus simulated ones.” 

Cyber incidents are human incidents 

One of the most striking lessons was the human cost of these incidents.

“These are husbands, wives, mums and dads making critical decisions under intense pressure,” the Co-op noted. 

Cyber incidents place intense human pressure on teams, often requiring weeks of extreme hours to maintain operations. The hidden human cost impacts well-being, clarity, and decision-making during a crisis. Boards and leaders must ensure that crisis plans consider team capacity, fatigue management, and staff well-being, not just technical recovery protocols.  

Communication shapes trust 

M&S and the Co-op both highlighted how important clear, honest communication is during an incident. The Co-op, being a member-owned organisation, prioritised transparency with its members as soon as they had clarity on what data may have been accessed, using emails, website updates, and market notifications. M&S reflected on the challenge of managing communication under public scrutiny, balancing transparency with the need to support an ongoing investigation. 

The learnings from M&S and the Co-op are not about scaring ourselves into inaction. They are about recognising that these threats are real, that being prepared means more than having the right software in place, and that resilience is a layered, practical mindset. 

Resilience is layered, not linear 

Both organisations reflected on the practical value of layered defences, of patching systems regularly, and of reducing legacy risks wherever possible. The Co-op noted that

“we often look at cyber security as being about tools that prevent everything, but actually, one of the biggest vulnerabilities is around legacy systems that may no longer be patched.”

This is a particularly important reminder for organisations with older systems still core to operations. 

They also spoke about business continuity in a grounded, practical way. This means asking: if your systems go down, can you still pay your staff? Can you still serve your customers? Do your teams know who does what if the internet goes down or the payment system fails? Having a plan to revert to manual processes, even for a few days, can be the difference between continuity and chaos. 

Insurance came up too, but with nuance. The Co-op chose not to insure specifically against this type of event, relying on prevention and their strengthened balance sheet, while M&S structured their insurance to cover catastrophic incidents, expecting a significant claim. Insurance is not the solution but can be part of a layered resilience strategy. 

Why this matters for your organisation 

Cyber attacks are happening to organisations of all sizes, and the way you prepare now will determine how well you respond when the lights flicker. Prevention is essential, but resilience, the ability to recover, maintain customer trust, and protect your people under pressure, is what will define your organisation in a crisis. 

At CIH, these insights reinforce why we prioritise immersive exercising and testbeds that help teams practice crisis management, system recovery, and communication under pressure, so that when (not if) an incident happens, your people know what to do, and you can recover safely while protecting your customers and your organisation.  

If you’d like to talk about what preparing practically for these realities could look like for your organisation (no matter the sector) or want to run a short scenario exercise to test your plans in a safe environment, we’re here to help. Because cyber resilience is more than protection, it’s recovery, continuity, and confidence, and keeping your operations going. 

What you can do today 

Start small, but start. Check your backups. Talk to your team about what happens if your systems go down tomorrow. Review your customer communication plan for a cyber incident. 

Get in touch to explore how immersive exercising could work for your organisation. We’re always happy to chat.