The UK’s “Hall of Shame” Cyber Incidents: Big Brands, Big Bills, and the Same Old Mistakes
A quick note on wording: “worst record” can mean repeat incidents or largest impact. Public, verifiable data is patchy (many firms don’t publish total losses), so the examples below focus on major UK organisations where regulators, courts, filings, or credible reporting describe clear failings and material cost.
British Airways (IAG) — payment data theft on a huge scale
What happened
Attackers harvested customer and payment details after BA’s systems were compromised (2018). Regulators described the root issue as poor security arrangements.
What it cost (known, minimum)
- £20m ICO fine (final penalty).
- Additional costs (legal claims, incident response, technical remediation) were not fully itemised publicly in one definitive figure in the sources above.
What they did wrong (as described in the penalty analysis)
- Weak supply-chain access controls (e.g., supplier account not protected with MFA), enabling attackers to pivot inward.
- Insufficient internal controls/segmentation once inside (permissions and access control weaknesses increased blast radius).
- Data exposure pathways included redirect-style harvesting and sensitive data appearing in places it shouldn’t have (e.g., logs).
Expert/regulator quote
Elizabeth Denham (ICO): “When an organisation fails to protect [personal data]… those that don’t will face scrutiny…”
Marriott International — long-running breach inherited via acquisition (UK impact included)
What happened
A breach originating in Starwood systems (dating back years) was discovered in 2018; UK residents were among those affected.
What it cost (known, minimum)
- £18.4m ICO fine.
What they did wrong
- Insufficient monitoring and limited encryption were highlighted as key shortcomings in how data was protected.
- The case is a reminder that acquirers inherit security risk: if compromised systems come with the deal, the liability can come too.
TalkTalk — “basic steps” not taken, repeated warnings missed
What happened
A 2015 attack exploited web vulnerabilities (SQL injection) and exposed customer data; the ICO later documented earlier attacks on the same area and a lack of monitoring.
What it cost (known, minimum)
- £60m total bill reported (trading impact + exceptional costs).
- £400,000 ICO fine (then record-sized under the old regime).
What they did wrong
- Outdated software / legacy pages left exposed and apparently unmanaged.
- Poor monitoring: earlier similar attacks occurred, but no effective action followed.
Expert/regulator quote
ICO (via reporting): the breach “could have been prevented… if TalkTalk had taken basic steps…”
Capita — major outsourcer hit, with a rare “cost estimate” from a UK regulator
What happened
A 2023 incident involved unauthorised access and data exfiltration; the pensions regulator documented the operational risk given Capita’s role administering schemes.
What it cost (known, minimum)
- Estimated ~£25m costs (TPR’s estimate).
- Reported later: £14m ICO fine (as reported by Reuters/Guardian in 2025).
What they did wrong (as described by regulators/reporting)
- Weaknesses around preventing unauthorised access and the speed/effectiveness of response were criticised in coverage of the ICO decision.
- The episode underlined the risk concentration of critical third-party suppliers and the need for rehearsed continuity plans.
Expert/regulator quote
TPR: the incident showed the “very real threat” and estimated costs of £25m, plus disruption and reputational damage.
Royal Mail — ransomware disruption, real recovery spend disclosed
What happened
LockBit ransomware (Jan 2023) disrupted international shipping operations and later involved data-leak threats.
What it cost (known, minimum)
- ~£10m spent on remediation and improved resilience measures (reported via IDS disclosures).
What they did wrong (what the incident shows in practice)
Public reporting focuses more on disruption and recovery than a single confirmed “root cause”, but the practical lessons are consistent:
- Ransomware impact is worst where core ops depend on a small number of critical systems and workarounds are slow to scale.
- NCSC continues to stress the persistent LockBit-style threat to UK organisations.
Tesco Bank — cyber-enabled fraud + regulator detail on “foreseeable risk”
What happened
2016 attack exploited deficiencies in card design and fraud controls; attackers netted £2.26m over ~48 hours, per the FCA.
What it cost (known, minimum)
- £16.4m FCA fine.
- £2.26m stolen by attackers (netted), plus the cost of response/redress (FCA notes customers were fully compensated but doesn’t give one total bill figure in the excerpted section).
What they did wrong (FCA’s findings)
- Deficiencies in debit card design, authentication/fraud detection rules, and action taken against a foreseeable risk.
- A response the FCA said lacked enough “rigour, skill and urgency”.
Expert/regulator quote
FCA’s Mark Steward: “This was too little, too late… Customers should not have been exposed to the risk at all.”
Travelex — ransomware outage that tipped a firm already under pressur
What happened
Ransomware (early 2020) forced Travelex offline; staff reportedly had to use manual processes while systems were down.
What it cost (known, minimum)
- A single “all-in” loss figure is hard to pin down from public sources, but the attack was widely reported as a major contributor to administration/restructuring pressure.
What they did wrong (most consistently reported theme)
- Multiple credible security reports at the time pointed to an unpatched VPN/remote access vulnerability as a likely entry route.
EasyJet — large customer exposure, but (notably) no big UK fine outcome
What happened
EasyJet disclosed a sophisticated attack affecting ~9 million customers, including a smaller subset with card details taken.
What it cost (known, minimum)
- A definitive, public “total cost” figure isn’t consistently available in a single authoritative source.
- Reporting indicates the UK regulator later dropped the EasyJet investigation (so it doesn’t sit in the same “big fine” bracket as BA/Marriott).
What they did wrong
From public sources, this is less about a confirmed technical failing and more about impact and response. That’s why it’s included as a “big incident”, not a “worst-regulator-finding” case.
Patterns behind the biggest UK lapses
The same failures repeat across sectors
- Weak identity and access controls (especially third-party/supply chain access).
- Poor monitoring and slow detection/response (attackers linger; warnings missed).
- Legacy systems and “forgotten” web assets left unpatched/unowned.
- Inadequate resilience planning for operationally critical services and suppliers.
A reality check on “cost”
Fines are often the smallest line item. The expensive part is usually: incident response, business interruption, customer remediation, legal claims, and long-term rebuild—yet those totals are often not disclosed cleanly.
Sources and further reading
Primary / regulator sources
- ICO/EDPB materials on BA and Marriott enforcement.
- FCA press release on Tesco Bank fine and findings.
- The Pensions Regulator report on Capita incident and estimated costs.
- NCSC updates on LockBit threat.
Reputable reporting used above
- Guardian coverage of TalkTalk costs and EasyJet disclosure; Royal Mail ransom context.
- Wired analysis of TalkTalk impact; Computer Weekly on Royal Mail recovery spend.
- Reuters/Guardian reporting on Capita’s later ICO fine.
We have created Professional High Quality Downloadable PDF’s at great prices specifically for Small and Medium UK Businesses our main website. Which include various helpful Cyber related documents and real world scenarios your business might experience, showing what to do and how to protect your business. Find them here.
