--- title: "UK Ransomware Tracker, Public Dataset | Firevault" description: "A free, regularly updated dataset of disclosed UK ransomware incidents. Searchable by sector and year, with CSV download. Compiled by Firevault." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "Dataset", "name": "Firevault UK Ransomware Tracker", "description": "A continuously updated, public dataset of disclosed ransomware and major data-breach incidents affecting UK organisations. Compiled by Firevault from ICO disclosures and verified press reporting.", "url": "https://fire-vault.com/research/uk-ransomware-tracker", "license": "https://creativecommons.org/licenses/by/4.0/", "creator": { "@type": "Organization", "name": "Firevault", "url": "https://fire-vault.com" }, "keywords": [ "ransomware", "UK", "data breach", "cyber incidents", "CNI" ], "distribution": [ { "@type": "DataDownload", "encodingFormat": "text/csv", "contentUrl": "https://fire-vault.com/research/uk-ransomware-tracker" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) [Home](/)/ Research / UK Ransomware Tracker # UK Ransomware Tracker A free, citable dataset of disclosed ransomware and major data-breach incidents affecting UK organisations. Compiled by Firevault from ICO disclosures and verified press reporting. Updated quarterly. **20** UK incidents tracked. Cite as: _Firevault UK Ransomware Tracker_, fire-vault.com, accessed 22 August 2026. All sectors All years Download CSV (20) Organisation Sector Date Records Type Source Asahi Group Ransomware attack halted ordering, shipping and call-centre operations across Asahi's European and Japanese businesses, including UK subsidiary Fuller's parent operations. Manufacturing / Beverages 29 Sep 2026 Production systems disrupted Ransomware [Reuters](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/) Kido International Ransomware group Radiant published photos and profiles of nursery children, including safeguarding notes and parent contact details, in an extortion attempt. Education / Childcare 25 Sep 2026 Photos and personal data of ~8,000 children Ransomware and extortion [BBC News](https://www.bbc.co.uk/news/articles/c623d7v0e5xo) Collins Aerospace (RTX) Ransomware attack on Collins Aerospace's MUSE passenger processing software caused widespread flight delays and cancellations at Heathrow and other European airports. Aviation / Transport 20 Sep 2026 Check-in and boarding disruption across Heathrow, Brussels, Berlin Ransomware on third-party check-in software [BBC News](https://www.bbc.co.uk/news/articles/c789e7l1z7po) Jaguar Land Rover Cyber attack halted vehicle production at UK plants for several weeks. Categorised by the Cyber Monitoring Centre as a Category 3 systemic event with estimated economic impact of £1.9bn. Automotive / Manufacturing 2 Sep 2026 Production and IT systems disrupted Ransomware [BBC News](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo) Lidl GB Customer data exposed via a breach at a third-party marketing supplier. Lidl notified affected customers and the ICO. Retail 11 Jun 2026 Customer contact data (subset via supplier) Third-party supplier breach [The Guardian](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach) Adidas UK Attackers accessed customer contact information via a third-party customer service provider. No payment data or passwords affected. Retail 27 May 2026 Customer contact details (subset) Third-party customer service breach [BBC News](https://www.bbc.co.uk/news/articles/c78jkev1el2o) Legal Aid Agency (Ministry of Justice) Significant volume of personal data of legal aid applicants stolen, including criminal history, employment status and financial information. Digital service taken offline. Government 19 May 2026 2.1 million applicants (financial, criminal, contact data since 2010) Data breach and exfiltration [gov.uk](https://www.gov.uk/government/news/legal-aid-agency-data-breach) Peter Green Chilled Ransomware attack on a UK chilled-food distributor supplying Tesco, Sainsbury's, Aldi and M&S caused significant supply chain disruption. Logistics / Food supply chain 14 May 2026 Order and logistics data Ransomware [BBC News](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o) Co-operative Group Attackers exfiltrated data of all 6.5 million Co-op members. Store systems, payments and stock disrupted across the UK. Retail 2 May 2026 6.5 million members (names, contact details, dates of birth) Ransomware (Scattered Spider) [BBC News](https://www.bbc.co.uk/news/articles/cly7z9zj3l1o) Harrods Third UK retailer targeted in a wave of Scattered Spider-linked attacks following M&S and Co-op. Restricted internet access at sites as a precaution. Retail 1 May 2026 Attempted intrusion, limited disruption Attempted network intrusion [Reuters](https://www.reuters.com/business/retail-consumer/uk-luxury-retailer-harrods-latest-target-cyber-attack-2025-05-01/) Marks & Spencer Ransomware attack disrupted online orders, contactless payments and click-and-collect for weeks. Customer personal data (not payment card or password data) confirmed taken. Retail 25 Apr 2026 Customer contact details, order history Ransomware (Scattered Spider / DragonForce) [BBC News](https://www.bbc.co.uk/news/articles/c9q7q4nznydo) Capita plc ICO issued monetary penalty following the 2023 Capita cyber incident that exposed pension scheme member data across multiple UK trustees. Outsourcing / Pensions 10 Mar 2026 6.6 million individuals (originally disclosed 2023, ICO fine 2026) Ransomware / regulatory follow-up [ICO](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/capita-fine/) NHS Scotland Further tranche of patient and staff data published by INC Ransom following the 2024 NHS Dumfries and Galloway attack. Confirmed by NHS Scotland and Police Scotland. Healthcare 14 Feb 2026 Patient and staff records (regional) Ransomware (INC Ransom) [BBC News](https://www.bbc.co.uk/news/articles/cz9d4x3g5r5o) Synnovis (Guy's and St Thomas') Further patient data from the June 2024 Synnovis ransomware attack surfaced on leak sites, prompting renewed NHS notifications to affected London patients. Healthcare 22 Jan 2026 Pathology and patient data (further disclosures) Ransomware (Qilin) - follow-on [BBC News](https://www.bbc.co.uk/news/articles/c0k5lgd9d3ro) Royal Mail LockBit ransomware attack disrupted international mail services for 6+ weeks Logistics 2023 Operations halted Ransomware [BBC News](https://www.bbc.co.uk/news/business-64261380) British Library Rhysida ransomware attack caused £7M in damages and months of disruption Public Sector 2023 Undisclosed Ransomware [The Guardian](https://www.theguardian.com) Jaguar Land Rover Luxury car manufacturer targeted in cyber attack Automotive 2025 Undisclosed Cyber Attack [Reuters](https://www.reuters.com) Co-operative Group UK supermarket chain hit by significant cyber attack Retail 2025 Undisclosed Cyber Attack [BBC News](https://www.bbc.co.uk/news) Marks & Spencer Major UK retailer suffered cyber attack affecting millions of customers Retail 2025 9.4M Cyber Attack [BBC News](https://www.bbc.co.uk/news/articles/cq5g1v9vl2jo) NHS Scotland , 2026 Undisclosed Ransomware [Source](https://www.bbc.co.uk/news) ## Methodology Incidents are added when (a) the affected organisation has a UK presence and (b) the breach is confirmed by the organisation, the ICO, or two independent press sources. Data is reviewed and corrected continuously; corrections welcome at [research@fire-vault.com](mailto:research@fire-vault.com). Secured by Design Offline by Default [![Firevault - offline secure storage](/assets/logo-white-official-BKfZ19hm.png)](/) The world's first offline secure storage platform for data. Dedicated hardware. Physically disconnected. Online when you need it, offline when you do not. Not Cloud Not HSM Not SaaS Offline by Design Secure by design [ hello@fire-vault.com](mailto:hello@fire-vault.com) United Kingdom Independently certified by [ ![Cyber Essentials Certified](https://fire-vault.com/__l5e/assets-v1/6f8f42a2-89e1-4c20-938f-3f34d30bc90c/cyber-essentials-2026.png) ![Cyber Essentials Plus Certified](https://fire-vault.com/__l5e/assets-v1/8a77bf2c-6711-4762-b093-c4d650153bc9/cyber-essentials-plus-2026.png) ](https://registry.blockmarktech.com/certificates/) ### Stay Updated Security insights, product updates, and threat intelligence delivered to your inbox. Subscribe I agree to receive emails from Firevault. Unsubscribe anytime. ### Products Data Protection & Storage [ ![Offline Secure Storage product icon](/assets/vault-icon-BhL4-R9F.svg) Offline Secure Storage® (#OSS) A Digital Safe Deposit Box ](/offline-secure-storage) Network Evolution & Rapid Protection (#NEARP) [ ![Control product icon](/assets/control-icon-B9EWHzCT.png) Control Data Path Governance ](/control)[ ![Firebreak product icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak Physical Network Segmentation ](/firebreak) ### Firevault - [Offline Secure Storage® (#OSS)](/offline-secure-storage) - [LUV](/luv) - [Vault](/vault) - [Why OSS](/why-oss) - [Meet Firevault](/about) ### Solutions - [Keep Personal Data Secure](/oss-for-personal-records) - [Keep Customer Data Secure](/oss-for-customer-data) - [Keep Critical Data Beyond Ransomware](/oss-for-ransomware-recovery) - [Protect Director Data from Fines & Liability](/oss-for-directors-and-boards) - [Secure the Data Your Business Depends On](/oss-for-business) - [Keep Intellectual Property Secure](/oss-for-intellectual-property) - [OSS Use Cases](/oss-for-use-cases) - [Compliance & Risk](/compliance) - [Network Evolution & Rapid Protection (#NEARP)](/solutions/control) ### Resources - [Firevault Playbooks](/playbooks) - [The Leaders' Playbook](/playbook/leaders) - [Firebreak for Water Playbook](/playbook/firebreak-water) - [A Control Blueprint for AI](/playbook/ai-control-blueprints) - [Knowledge Vault](/learn/knowledge) - [White papers](/learn/whitepapers) - [How OSS Works](/how-oss-works) - [How OSS Physical Disconnection Works](/offline-secure-storage/what-is-oss) ### Company - [Press and Media](/press-media) - [Knowledge Vault](/learn/knowledge) - [FAQs](/learn/faq) - [Help Centre](/help) - [Careers](/careers) - [Invest in Firevault](/investors) [](https://www.linkedin.com/company/firevault-limited)[](https://www.facebook.com/profile.php?id=61581962517246)[](https://twitter.com/firevaultuk)[](/rss.xml) Firevault - Disconnect to Protect® [Site Map](/sitemap)● [Privacy Charter](/privacy-charter)● [Terms of Service](/terms)● [Planet Pledge](/planet-pledge)● [Vault User Commitment](/vault-commitment)● [LUV User Commitment](/luv-commitment)● [Cookie Policy](/cookies) © 2026 Firevault Limited Company No. 16320803 · VAT No. 490 8551 64 · Registered in England and Wales