cyber

Staff at Jaguar Land Rover (JLR) will be out of work for at least another week as the business secretary prepares to meet suppliers of the car maker who are at risk of closure.

JLR has confirmed that production in its factories – including its UK facilities in Solihull, Halewood and Wolverhampton – will remain suspended until at least October 1.

It previously said production would resume on September 24.

The company’s production lines ground to a halt in late August following a major cyber attack, and fears are growing that the company’s suppliers could go bust without support.

Business Secretary Peter Kyle will visit JLR for the first time since the attack to meet with the company and firms in the supply chain for the beleaguered carmaker.

“Our focus remains on supporting our customers, suppliers, colleagues, and our retailers who remain open,” the statement said.

“We fully recognise this is a difficult time for all connected with JLR and we thank everyone for their continued support and patience.”

Industry minister Chris McDonald said he was visiting JLR alongside the business secretary to “host companies in the supply chain, to listen to workers and hear how we can support them and help get production back online.”

He said in a statement: “We have two priorities, helping Jaguar Land Rover get back up and running as soon as possible and the long-term health of the supply chain.

“We are acutely aware of the difficulties the stoppage is causing for those suppliers and their staff, many of whom are already taking a financial hit through no fault of their own – and we will do everything we can to reassure them that the government is on their side.”

Suppliers are anxious to be heard, according to Johnathan Dudley, the head of manufacturing for accounting and consulting firm Crowe UK. The firm is based in the West Midlands, which is where the Solihull and Wolverhampton plants are.

“Obviously, they’re being very, very cautious because they don’t want to create panic, and equally, they don’t want to be seen to be criticising people further up the chain,” he said.

“It’s not a blame game, but it is a cry for help, because there are businesses now seeing people not paying [staff].”

The halt in production had hit profits by about £120m already, and £1.7bn in lost revenue, according to David Bailey, Professor of Business Economics at the University of Birmingham.

JLR is currently taking the lead on support for its own supply chain, rather than any state intervention.

Sept. 21 (UPI) — Officials at London’s Heathrow airport are warning of a second day of delays for travelers after a cyber attack disabled a passenger check-in and baggage system.

The problem resulted in hundreds of delayed flights at several European airports on Saturday and left workers using pen and paper to check passengers in for their flights.

At least 90% of the 350 scheduled departures at Heathrow had been delayed, most by at least 15 minutes. Six had been delayed as of Sunday afternoon, according to Flightradar24, which tracks air traffic. Thirteen flights were canceled on Saturday, but most of the hundreds of scheduled flights were delayed.

A Heathrow spokesperson said the “underlying problem was outside our influence” and added that the airport brought on additional staff to help manage the situation.

“We apologize to those who have faced delays, but by working together with airlines, the vast majority of flights have continued to operate,” the spokesperson said.

There was no timeline for a return to a fully functional system, officials at Brussels Airport said, where authorities asked several air carriers to cancel at least half of their flights scheduled to depart on Monday.

RTX, owner of the software provider Collins Aerospace, said it was “aware of a cyber-related disruption” to its system in some airports, and that it was working to resolve the situation, the BBC reported.

The company has not disclosed the error in its software that caused the system to shut down, or how long the outage could last, but added that the disruption would stretch into at least until Monday because Collins has yet to provide a secure software update or any recommendations on a solution, airport officials said.

Airports urged travelers to check flight status before heading to the airport and recommended they arrive at their selected airport no earlier than three hours prior to long flights and at least two hours before shorter ones.

In November 2023, Canberra launched the 2023–2030 Cyber Security Strategy, pledging A$587 million, and six integrated “Cyber Shields” to make Australia the world’s most cyber-secure nation by 2030. Yet continuous compliance, the muscle behind that ambition, is still scarce on the ground. Meanwhile, the Australian Signals Directorate logged nearly 94,000 cyber-crime reports in 2022–23—roughly one every six minutes. Strategy is set; the reality check is already here.

Australia’s 2030 vision and six Cyber Shields

From Horizon 1 to Horizon 3 – the road map in plain English

Horizon 1 (2023–2025)

Horizon 2 (2026–2028)

Horizon 3 (2029–2030)

Gaps exposed – Essential Eight and beyond

Incident reporting and third-party risks

The pitfall of “tick-the-box” security

From annual audit to continuous assurance

Platforms offering continuous GRC automate control monitoring and evidence collection, feeding live telemetry into a dashboard that alerts you the instant a critical patch slips or a new admin account appears in production. Instead of scrambling for screenshots once a year, your controls report their health every day through emerging concepts like cyber deterrence and digital resilience, powered by live integrations from Vanta with AWS, Okta, and dozens of other systems. Evidence no longer sits in email threads; it streams straight from cloud consoles, identity providers, and endpoint agents into a unified system of record. Organizations using Vanta automate evidence collection for frameworks like SOC 2 and ISO 27001, shortening audit prep from months to weeks. Auditors view the same live feed on demand, regulators receive fresher data, and security teams reclaim weeks once lost to manual checklists.

The change sounds subtle, yet it reshapes the workflow. Evidence no longer sits in email threads; it flows straight from cloud logs, identity stores and endpoint agents into a single system of record. One automation platform’s customer, Solidroad, used this always-on pipeline to complete ISO 27001 certification in under three months. Auditors view the same feed on demand, regulators receive fresher data and security teams reclaim weeks once lost to manual checklists.

Real-time telemetry also catches compliance drift the moment it begins. A mis-scoped IAM policy triggers an alert before it turns into a breach headline, turning assurance into a feedback loop rather than a rear-view mirror.

The benefits cascade: incident responders work from live asset inventories, risk managers track accurate scores and board decks condense weeks of spreadsheet work into a single click. In short, continuous assurance lets your security posture evolve as fast as the threat landscape, matching the tempo Canberra’s 2030 cyber vision demands.

Manual versus automated – spot the difference

Manual compliance is a marathon of screenshots, spreadsheets and pleading with busy colleagues for logs. Preparing for ISO 27001 can stretch beyond a year and swallow five-figure consultant fees; however, organisations pursuing multi-site certification have slashed audit spend by up to 40 percent using eight proven tactics. SOC 2 is even hungrier: one brokerage needed 24 months and well over six figures in staff hours and audit costs to reach Type II the old-fashioned way.

Automation reverses the burden. Evidence flows from cloud consoles and IAM stores, and control drift triggers an alert instead of a line item for next quarter. Vendor case studies claim that companies like Newfront Insurance and Abmatic AI have significantly reduced certification timelines

The numbers speak for themselves. What once consumed twelve to twenty-four months now fits inside a single quarter, or even a single sprint, when controls test themselves and auditors can review evidence in real time. Because monitoring never pauses, the certificate you earn in March still matches reality in May.

Building trust and cutting costs

Supporting Strategy goals

Next steps for organisations

Conclusion

Aug. 27 (UPI) — The State of Nevada was the target of a cyberattack, and recovery efforts are ongoing, according to the office of Gov. Joe Lombardo.

A “network security incident” affecting state systems was identified Sunday, and recovery efforts were initiated, Lombardo’s office said Tuesday in a recorded statement, adding some state websites and phone lines may be slow or offline as a result.

“At this time, there is no evidence that personal information has been compromised,” according to the recorded statement published on X.

“The issue affects only state government systems.”

A statement from the governor’s office further said that the incident is under state and federal investigation and was unable to provide technical details about the intrusion.

“The State is focused on restoring services safely and validating systems before returning them to normal operation,” it said.

The Nevada Department of Motor Vehicles is one of several state agencies affected by the statewide network outage.

On X, it said in a statement that all offices are closed until further notice.

“The DMV is currently working to resume normal business operations,” it said.

Nevada State Police said its administrative offices and online services were unavailable Tuesday, though the governor’s office said emergency call-taking and essential services, including 911, remain available statewide.

The rapidly evolving nature of AI is a double-edged sword as far as cybersecurity goes. As user-friendly and beneficial as Generative AI (Gen AI) can be, it is also being misused ever more frequently in the form of trickery and manipulation, such as deepfaking the voice, face or name of a person or organisation to elicit payments. By 2027, for example, 17% of total cyberattacks will involve the use of Gen AI, according to Gartner¹. This figure is expected to rise quickly.

While high-profile incidents continue to underscore the scale and sophistication of AI-driven threats, the same technology also equips companies with powerful, proactive tools to defend their critical infrastructure and stay ahead of attackers. For example, detecting patterns to identify intrusions into networks, or spotting new malware and other threats can flag unusual and potentially harmful activity much quicker than any human could.

As a result, AI’s role in cybersecurity has evolved from a technical issue into a strategic business imperative. 

“Cybersecurity is one of the key concerns today, and companies are investing heavily to combat this”
Aaron Chiew, Head of Digital Channels for DBS’ Institutional Banking Group

AI’s dark side: New frontiers in cyber threats

AI AI brings powerful capabilities, but those same capabilities are amplifying cyber risks in three major ways:

• Accelerated processing times – AI can process vast datasets very quickly, enabling scammers and fraudsters to identify exploitable patterns and design new scam tactics with unprecedented efficiency.
• The prevalence and believability of deepfakes – a case in point was in Hong Kong, where deepfake technology was used to impersonate company executives on a video call, successfully convincing an accounts clerk to transfer $25 million to fraudsters.²
• Rapid creation of deceptive or manipulative information in the form of scam content – including automating scam calls, generating realistic looking fake ads, and creating websites that mimic legitimate businesses to trick people into providing sensitive information or making unauthorised payments.

Such threats have far-reaching repercussions, beyond the obvious financial losses. One of the most damaging is the erosion of trust, both within the organisation and with clients.

For example, Chiew noted employees may start to question the authenticity of the calls they receive, uncertain whether they’re truly speaking to the person they believe they are. This growing uncertainty could lead to more verification steps and processes to confirm the legitimacy of communications. “What might have been a quick transaction in the pre-AI world could now take much longer,” he said. “Whether businesses can maintain the same level of operational efficiency going forward is increasingly uncertain.”

The damage doesn’t stop at the office door. Rebuilding trust with customers can take a long time once a cybersecurity incident becomes public knowledge.

Stepping up defences against AI cyber threats

Companies are not standing still in this new era, with the threat from AI now top of mind. For example, 66% of organisations expect AI to have the most significant impact on cybersecurity in the year to come³.

In response, investment in cybersecurity protection measures has risen significantly across various industry sectors. For example, in August 2024, Gartner projected that global end-user spending on information security would grow by 15% this year to $212 billion⁴.

At the same time, companies are reviewing their processes and implementing stricter communication policies with regard to the role of AI tools as an advanced way to quickly spot and respond to dangers, said Chiew. “They are relooking at how they interact with each other in a digital space, to understand how they implement these cybersecurity protection measures safely so the current processes can run smoothly.”

This is triggering action such as more defined data protection policies in terms of collection and storage, along with stricter guidelines for using social media, plus regular penetration testing of systems and infrastructure.

Turning cyber risk into operational resilience

Companies are at different stages of their cybersecurity journey, but in all cases a clear and structured path to protection is essential.

According to Chiew, early-stage companies should start with the basics:

1. Verify all requests carefully

Always double-check the credibility of requests received by email – especially those involving sensitive financial changes. For instance, if an employee requests a payroll update or a supplier emails to change bank details, confirm the request by calling back using a verified number on record.

2. Audit your internal processes

Regularly review internal workflows to identify weak points that could be exploited through human error or fraud. Even small procedural gaps can open the door to cyber threats.

For mature-stage companies, the key is to strengthen and stress-test:

1. Invest in penetration testing

Engage cybersecurity professionals or specialist agencies to conduct penetration testing and simulate attacks. This helps uncover vulnerabilities in systems, processes, or infrastructure before attackers do.

2. Continuously monitor and upgrade systems

Periodically review your infrastructure and security protocols to stay ahead of evolving threats. As Chiew warns: “It only takes a single loophole or gap – and for scammers, finding and exploiting these gaps is a full-time job.”

Explore DBS’ resources for businesses to protect against scams: https://go.dbs.com/ProtectYourBusiness

In the digital age, where power dynamics are increasingly defined by information flows and algorithmic influence, cyberspace has evolved from a mere technical domain into a fully fledged geopolitical arena. As Thomas Rid has argued, cyberwar is not a rupture but an extension of politics by other means, characterized by ambiguity, plausible deniability, and the absence of clear thresholds. In this new order, cybersecurity acts as an adaptive shield, protecting vital systems, while cyber defense becomes the digital sword, mobilizing state capabilities to detect, neutralize, and retaliate. This strategic pairing gives rise to an integrated doctrine, where every firewall becomes a sensor and every breach an opportunity for strategic hardening.

Thus, twenty-first-century conflicts no longer begin with declarations of war but with lines of malicious code. State-sponsored cyberattacks, technological espionage, and mass disinformation campaigns are the weapons of the future: silent yet potentially paralyzing. In this shadow war, financial systems, smart grids, healthcare infrastructures, and state institutions become critical pressure points, exposed to systemic shocks that can dislocate national continuity. In response, digital resilience is no longer a defensive posture but a vital imperative. It rests on the fusion of preventive cybersecurity and active cyber defense, forming an invisible architecture that balances anticipation with response. Partnerships like the one between Microsoft and U.S. Cyber Command, where Azure Sentinel’s AI bolsters offensive operations against Chinese APTs, illustrate the hybridization of technological shield and geopolitical weapon. Yet attribution remains a strategic Achilles’ heel; opacity and decentralization of attacks hamper deterrence logic.

For these reasons and inspired by nuclear doctrines, some states are now developing cyber deterrence strategies based on denial (making the attack ineffective) and targeted retaliation (imposing dissuasive costs). The U.S. Cyber Command’s “persistent engagement” model exemplifies this approach, where anticipation, calibrated response, and cognitive dominance form a triptych of integrated deterrence. On the other hand, the rise of artificial intelligence is disrupting this balance at dizzying speed. China’s DeepSeek R1, for instance, demonstrates that AI is no longer merely a tool for data processing but an autonomous force capable of identifying threats, executing countermeasures, and even making tactical decisions. This signals the emergence of a new form of algorithmic sovereignty, where strategic initiative shifts from human to calculated agency.

This paradigm shift is reshaping the military domain as well. Autonomous drones, automated intelligence platforms, and smart weapons systems are redefining doctrines of technological supremacy. Ukraine’s “Spider Web” operation marked a doctrinal rupture, deploying swarms of AI-coordinated micro-drones capable of dynamic, adaptive targeting in cluttered environments. It heralds the advent of fluid, decentralized warfare and prefigures future algorithmic conflicts.

Big Tech: Geopolitical Hydras

When Big Tech dictates the rules of cyberspace, states become variables in someone else’s equation. It is no longer armies but platforms that shape power balances. This paradigm shift cements the rise of an extraterritorial technological power not based on monopoly of legitimate violence but on mastery of data flows and digital architectures. Then, GAFAM (Google, Apple, Facebook, Amazon, Microsoft) now operates as systemic entities, wielding influence that eclipses traditional state sovereignty. Their power, driven by an unprecedented concentration of computational, financial, and informational capital, grants them a structuring role in international relations, rivaling even the core prerogatives of the state.

This rise isn’t merely economic or technological; it redefines global governance. These corporations act as the architects of the “matrix politica,” enforcing opaque algorithmic regulation of public discourse, social behaviors, and collective perception. By replacing legitimate legal norms with proprietary logic, they institute an unelected algorithmic order, generating “invisible prisons” where individuals become exploitable variables and national sovereignty becomes a residual fiction.

In this context, any viable cyber defense or deterrence strategy must confront this structural asymmetry. Strengthening state defenses against conventional cyber threats is no longer sufficient. The relationship between public authority and private technological hegemony must be recalibrated. Effective digital resilience demands a democratic reconquest of communication infrastructures and political oversight of the normative power wielded by platforms. Absent such rebalancing, cyberspace will continue to slide into a deterritorialized algorithmic sovereignty that deeply reconfigures the exercise of power in the 21st century.

This silent capture of normative power presents a strategic challenge to cyber deterrence doctrines. After all, what is the purpose of state deterrence if critical infrastructures, codebases, and mass cognitive systems are controlled by transnational private entities? Digital sovereignty must encompass offensive capabilities against state-backed cyber aggressors and against hegemonic drifts of platforms capable of reshaping cognitive battlegrounds, manipulating public perception, and influencing political decisions in real time.

This revolution comes at a cost. Deep learning algorithms can now launch sophisticated cyberattacks, detect invisible vulnerabilities, and strike without warning, pushing human intervention into the background. AI thus generates a strategic paradox: it enhances resilience while simultaneously magnifying vulnerabilities. Advances like DeepMind’s AlphaFold show how such technologies permeate critical domains, from biology to cybersecurity, blurring the lines between scientific progress and digital militarization. In this new era, AI is no longer a tool; it is a geopolitical actor.

In fact, major powers and actors are investing in this revolution in different ways. The United States, a pioneer in AI research, focuses on innovation and developing offensive and defensive cyber capabilities. China, aiming for technological supremacy by 2030, is coupling digital sovereignty with state surveillance to bolster its global position. The European Union adopts a more regulatory and ethical approach, seeking to govern AI use while preserving its technological autonomy.

Warfare in the Age of AI

The military domain, too, is being swept into the vortex of AI-led automation. Autonomous drones, smart weapon systems, and automated intelligence platforms are reshaping defense doctrines, ushering in a new form of technological supremacy. These tools offer asymmetric advantages to well-equipped powers but also pave the way for an unprecedented militarization of cyberspace.

Delegating lethal decisions to machines raises profound ethical dilemmas: who bears responsibility for algorithmic misfires? How do we regulate autonomous weapons in a world where legal norms lag behind innovation? Without clear answers, AI risks transforming the battlefield into a dehumanized theater of operations beyond political and moral control.

Subsequently, the proliferation of hybrid threats, cyberattacks, disinformation, and covert operations underscores the urgency of enhanced international cooperation. In fact, the Russo-Ukrainian conflict has highlighted cyberspace’s centrality in modern warfare, with the rise of cyber-volunteers, hacktivists, and destabilization campaigns. Ukraine’s IT Army exemplifies a new form of cyber mobility, where citizens and transnational collectives become key players in cyber conflict.

In this regard, Ukraine’s “Spider Web” operation against Russian targets demonstrates a new military application of AI in hybrid warfare. Here, AI no longer acts as a mere optimizer but as a digital war commander, orchestrating data collection, target identification, battlefield navigation, and dynamic strike execution. This machine-learning-powered architecture transforms each drone into both a sensor and a lethal vector, capable of real-time adaptation. More than a technological feat, Spider Web signals a metamorphosis of warfare, with AI assuming operational control and ushering in an era of autonomous algorithmic wars.

Fragmented Tech Ecosystems and Strategic Rivalries

Meanwhile, the militarization of cyberspace is accelerating. Leading powers are developing advanced cyber weapons, espionage tools, and surveillance systems to maintain digital supremacy. China’s “Made in China 2025” strategy channels massive investment into cybersecurity and tech sovereignty, while the U.S. doubles down on proactive defense to safeguard its hegemonic edge.

This trend drives increasing fragmentation of the global digital landscape, undermining the ideal of an open internet and encouraging the formation of rival digital blocs. The Sino-American tech rivalry extends beyond infrastructure development, despite enduring interdependencies in key sectors. While semiconductor and 5G decoupling advances, shared reliance persists in AI, cloud computing, and components. This duality complicates strategic choices. Each power must navigate between tech independence and global innovation access, accelerating cyber-nationalism and deepening digital polarization. Huawei’s Harmony OS and U.S. bans on Chinese semiconductors are clear signs of a growing digital decoupling that could redefine global tech ecosystems.

In this climate of intensifying threats and systemic interdependence, states are turning to cyber sovereignty strategies to secure critical infrastructure and reduce exposure to foreign interference. This forms part of a broader reconfiguration of global digital order, where control over data and information flows becomes a strategic lever.

International bodies such as NATO and the EU are gradually adapting. The EU’s Cyber Rapid Response Teams (CRRTs) and NATO’s adoption of offensive cyber doctrines signal a growing intent to pool resources and establish collective response mechanisms. Thus, China exemplifies the sovereigntist approach: its Great Firewall symbolizes a strategy combining national infrastructure protection, strict data regulation, and bolstered cyber-offensive capabilities.

From Code to Context: Redefining Cyberwarfare

Cyberwarfare is no longer about code but about context. Victory lies in merging civilian neural networks, predictive algorithms, and bio-neural systems, where every smartphone becomes a sensor and every hacktivist a cognitive disruptor. Tomorrow’s cyber defense rests on algorithmic sovereignty: an ecosystem where tactical metaverses, morphic AI drones, and quantum blockchains redefine resilience. In addition, Ukraine has shown that the future belongs to those who break hierarchies to build combat bio-networks—info-centric systems powered by quantum geolocation and operational proliferation of cyber volunteers. In this borderless arena, victory is won not by hacking machines but by hacking perceptions, hybridizing human agency, generative AI, and legal ambiguity.

Furthermore, cybersecurity is no longer a static defense line but a fractal weapon with evolutionary capabilities, where every intrusion becomes a counter-weapon and every psychokinetic attack an information battleground. That’s to say, this next-gen cyber architecture is based on adaptive algorithmic systems capable of dynamic reconfiguration in the face of ever-mutating threats. Its strength lies in an advanced synergy of AI, quantum cryptography, and autonomous protocols—modular, decentralized, and self-replicating systems that respond proportionately to the intensity and nature of cyberattacks. In a world shaped by asymmetry and uncertainty, this model grants states algorithmic superiority, shaping tomorrow’s deterrence and digital resilience.

Therefore, in the face of this accelerating tech revolution, global AI governance is no longer optional—it’s an existential necessity. Without robust legal frameworks and multilateral oversight, the world risks plunging into a digital arms race defined by opacity, irresponsibility, and strategic instability. It is no longer about regulating innovation; it is about preserving global balance in a world where the boundaries between war and peace, civil and military, and human and machine are increasingly blurred. Namely, an international architecture of trust and transparency is essential to prevent AI from becoming the unaccountable arbiter of tomorrow’s conflicts.

Disruption Scenario: Toward Unchecked Algorithmic Warfare

By 2032, the lack of international regulation on military AI triggers an uncontrolled rise of autonomous weapons and AI-powered cyber capabilities. Amid mounting tensions between the West and the Sino-Russian bloc, the race for AI military supremacy enters a tipping point. China, after scaling up AI militarization with Central Asian partners, unleashes targeted cyberattacks against European logistics and energy systems, paralyzing large parts of the continent. Simultaneously, autonomous drone swarms developed under a Sino-Russian program infiltrate NATO airspace disguised as meteorological probes.

Behind the scenes, Russia orchestrates a massive cognitive warfare operation using generative AI trained to manipulate Western public opinion. Deepfakes, forged documents, and fake military orders—Europe’s political systems are plunged into information chaos. In several capitals, key decisions are based on alerts fabricated by hostile AI. Thus, a devastating strike then hits a NATO logistics hub in the Baltic Sea, causing significant casualties. No state claims responsibility, but suspicion falls on Russia. Western attribution systems, despite being AI-enhanced, are circumvented by adversarial AI obfuscation networks. Indeed, caught in a spiral of disinformation and decision paralysis, a NATO member launches a massive cyber counterattack on Russian civilian infrastructure. Moscow retaliates with a hybrid strike combining autonomous weapons, electronic warfare, and satellite disruption. Within a week, a high-intensity hybrid conflict erupts regionally, with immediate nuclear escalation risk. Traditional command chains are disabled, decisions are made under AI pressure, and human agency vanishes. Strategic equilibrium, once upheld by nuclear deterrence and diplomacy, collapses under the weight of self-evolving, autonomous algorithms.

Moreover, conflicts no longer begin with declarations of war: they emerge, self-perpetuate, and unfold in an algorithmic fog where the line between peace and hostility vanishes. Humanity then realizes that, in failing to regulate, it has surrendered control to hostile, elusive, and autonomous intelligences.

Coding Sovereignty in the Algorithmic Fog

The future of cybersecurity lies in the ability of states to reconcile innovation, regulation, and strategic cooperation. The implementation of robust cyber doctrines, blending deterrence, algorithmic resilience, and control over critical infrastructure, will be key to preserving national sovereignty and global stability. That is to say, in the age of information supremacy, building cyber coalitions, massively investing in sovereign digital infrastructures, and establishing binding international norms are essential to secure peace and security. Cybersecurity is no longer a defensive tool; it is a core pillar of state power.

This indicates that cyberwar is no longer a future scenario; it is a strategic reality where supremacy depends on integrating offensive and defensive capabilities into a deterrent cyber ecosystem. The convergence of cyber intelligence, algorithmic resilience, and anticipatory response is reshaping defense doctrines, establishing a digital sovereignty rooted in system self-learning, cognitive warfare, and adversary vulnerability exploitation.

Finally, in this asymmetrical theatre, mastery over critical infrastructure and the ability to conduct hybrid operations will determine the balance of power in a cyberspace that has become the epicenter of global strategic rivalries. In the algorithmic fog of tomorrow’s wars, sovereignty is no longer declared, but it is coded, learned, and defended with every line of data.

Marks and Spencer is beginning to take online orders again after it halted purchases through its website in April following a hugely damaging cyber attack.

The High Street chain said shoppers were now able to buy a selection of fashion items, such as clothing and footwear, for home delivery in England, Scotland and Wales.

It said beauty and homeware products would be available in the coming days, with click and collect and delivery services to Northern Ireland resuming “in the coming weeks”.

The return of online shopping marks a key milestone for the retailer, which has been struggling to get services back to normal since the cyber attack, which left some shelves empty and deliveries in limbo.

M&S was hit by a cyber attack over the Easter weekend, which initially affected its click and collect and contactless payments.

A few days later, the company suspended online orders, and recently warned services would continue to be disrupted until July.

On Tuesday, John Lyttle, managing director of fashion, home and beauty at M&S, said a selection of the retailer’s “best selling” fashion ranges would now be available online.

M&S has estimated that the cyber attack will hit this year’s profits by around £300m – the equivalent to a third of its profit – and a sum that would only partly be covered by any insurance payout.

Some personal customer data was stolen by hackers during the attack, which the retailer has said could have included telephone numbers, home addresses and dates of birth.

The company has told customers that the data theft did not include useable payment or card details, or any account passwords.

The BBC learned earlier this week that the hackers sent an abuse-filled email directly to M&S’s boss on 23 April, gloating about what they had done and demanding payment.

The message to chief executive Stuart Machin, which was in broken English, was sent from the hacker group DragonForce using an employee email account.

DragonForce offers cyber-criminal affiliates various services on their darknet site in exchange for a 20% cut of any ransoms collected.

The email confirmed that M&S was hacked by the ransomware group – something that the retailer has so far refused to acknowledge.

Mr Machin has refused to disclose whether the company has paid a ransom to the hackers or not.

MARKS and Spencer has issued an update for customers with gift vouchers after its cyber attack.

Customers have taken to social media to share their dissatisfaction with the retailer’s latest update.

1

It comes as the ongoing chaos has left scores of M&S shoppers unable to use their gift vouchers.

Yet the retail giant initially told customers they won’t get extensions of the expiry dates on vouchers due to expire.

One customer took to X, pleading: “My vouchers expire at the end of this month but I can’t use them. Can I have them extended?”

But M&S responded: “Unfortunately we’re unable to extend vouchers.”

They later appeared to soften, agreeing to “double check” on the customers behalf.

Last month, shoppers also said they’d hit a brick wall.

One couple revealed on the MoneySavingExpert forum that they’ve been saving up vouchers from their M&S credit card for months, only to be told they’d have to use them now or lose them entirely.

The customer posted: “We contacted M&S Customer Support which bluntly said that if we didn’t use the vouchers by their expiry date then that was tough.

“The only option we have is to spend them on something we don’t really need.”

They added that M&S stores aren’t even able to place orders, meaning customers can’t just pop in and buy bigger items either.

Even staff are reportedly unable to order stock, with fears some branches could start running out of essentials altogether.

Some stores have even been stripped of staples like bananas and Colin the Caterpillar cakes, and popular meal deals were pulled in smaller branches

An MSE forum ambassador said: “Given the number of people this may affect, perhaps thousands as you suggest, I would expect M&S to extend the end date for these.”

While another shopper fumed: “The least they could do is extend the date.”

M&S credit card reward vouchers are valid for 17 months, while shoppers with gift cards have 24 months from the last transaction to spend them.

When The Sun contacted M&S, it advised affected customers to get in touch – but didn’t confirm whether it would offer extensions on a case-by-case basis after all.

A M&S spokesperson said: “The majority of M&S credit card customers redeem their reward vouchers in stores, and they can continue to do so.

“If for any reason customers aren’t able to redeem in store, and their vouchers are due to expire soon, we would ask them to get in touch with us so we can support them.”

Meanwhile, the attack is still causing carnage across the business.

M&S was forced to pull online orders, birthday perks were suspended, and Sparks offers were frozen.

The store has now confirmed that some freebies, like birthday cookies, will still be honoured eventually.

But when it comes to Rewards Vouchers — a perk many customers save up to use for larger purchases — the answer so far is a hard no.

The cyber attack, which kicked off over Easter weekend, has been one of the worst to hit the high street in years.

It has forced M&S to halt online orders and triggered widespread disruption, including a £300million blow to profits.

Customer info was also nicked during the breach, with security experts now blaming “Scattered Spider”— a notorious cyber gang thought to be behind the chaos.

Online shopping is still out of action and is expected to remain patchy until at least July, with fashion, home and beauty sales taking a battering.

Meanwhile, M&S isn’t the only store facing cyber trouble.

Co-op was forced to shut down part of its IT system after facing a hacking attempt last month.

It confirmed that it had “taken proactive steps to keep our systems safe”.

It was later revealed that the personal data of a “significant number” of its 6.2million customers and former members had been stolen.

The details included names, contact information, and dates of birth.

However, the retailer assured customers that passwords, credit card details, and transaction information were not compromised.

Full services resumed on May 14, following the reactivation of its online ordering system.

The Marks & Spencer website is down, leaving users unable to browse, as the retailer continues to deal with the aftermath of a cyber-attack last month.

Customers have been unable to make online orders for weeks but on Wednesday evening users were met with a screen reading: “Sorry you can’t browse the site currently. We’re making some updates and will be back soon.”

M&S has been contacted for comment.

Earlier in the day, the retailer said it estimates that the cyber-attack will hit this year’s profits by around £300. It added that its online services would continue to be disrupted until July, with a gradual return to normal.

Following the cyber attack, M&S said some personal customer data was stolen in the recent cyber attack, which could include telephone numbers, home addresses and dates of birth.

The High Street giant assured customers that the data theft did not include useable payment or card details, or any account passwords, but added that online order histories could be included in the personal data stolen.

The attack took place over the Easter weekend, initially affecting click-and-collect and contactless payments. A few days later M&S put a banner on its website apologising that online ordering was not available.

M&S estimates that the cyber attack will hit this year’s profits by around £300m – more than analysts had expected and the equivalent to a third of its profit – a sum that would only partly be covered by any insurance pay-out.

“Over the last few weeks, we have been managing a highly sophisticated and targeted cyber-attack, which has led to a limited period of disruption,” said M&S chief executive Stuart Machin.

Police are focusing on a notorious group of English-speaking hackers, known as Scattered Spider, the BBC has learned.

The same group is believed to have been behind attacks on the Co-op and Harrods, but it was M&S that suffered the biggest impact.

The digital battleground has become an increasingly critical theatre for modern geopolitical conflicts, and the Taliban’s recent social media campaign targeting the United Arab Emirates (UAE) and Saudi Arabia (KSA) underscores this shift. Following the UAE’s warm reception of former U.S. President Donald Trump, a surge of hostile online activity emerged, orchestrated by Taliban-linked accounts under the General Directorate of Intelligence (GDI). This campaign, executed through human-operated parody profiles, blends religious rhetoric, violent threats, and geopolitical grievances to undermine Gulf states’ legitimacy while reinforcing the Taliban’s ideological stance. The sophistication of this operation reveals not just a localized grievance but a broader strategy of asymmetric warfare, leveraging digital tools to exert influence beyond Afghanistan’s borders.

Central to the Taliban’s messaging is the accusation that the UAE has “disgraced Islam and the Ummah” by engaging with Trump, a figure historically criticized in the Muslim world for policies such as the travel ban on several Muslim-majority nations and his administration’s unwavering support for Israel. By framing the UAE’s diplomatic overtures as a betrayal of Islamic solidarity, the Taliban seeks to galvanize conservative Muslim audiences, casting Gulf states as Western collaborators. This narrative is not new, extremist groups have long employed religious rhetoric to isolate moderate Muslim nations, but the Taliban’s institutionalized use of social media amplifies its reach and potency.

Beyond ideological condemnation, the campaign escalates into explicit threats, with multiple accounts referencing the “yellow keg”, a signature Taliban improvised explosive device (IED) used extensively against US forces during the 2001–2021 conflict. The deliberate invocation of this imagery serves a dual purpose: it signals the Taliban’s continued embrace of violent tactics while psychologically intimidating its targets. Such threats, even if symbolic, carry the risk of inspiring lone actors or affiliated militant cells to pursue physical attacks, particularly given the historical precedent of Taliban-linked violence extending beyond Afghanistan’s borders.

While the UAE remains the primary target, the campaign’s inclusion of Saudi Arabia suggests a broader ideological offensive against Gulf monarchies perceived as aligning too closely with Western powers. The use of Pashto and Dari, languages dominant in Afghanistan but also understood among diaspora and regional jihadist circles, ensures localized resonance while maintaining plausible deniability for the Taliban’s central leadership. This linguistic choice, combined with the recycling of accounts historically used to promote Taliban edicts, reinforces the campaign’s authenticity within its intended audience.

The campaign’s timing, thematic coherence, and operational signatures point to centralized coordination, likely emanating from the Taliban’s GDI. Unlike fragmented extremist online activity, this effort displays a clear command structure, mirroring the Taliban’s disciplined approach to information warfare. The reuse of accounts previously associated with official Taliban narratives further underscores institutional involvement, distinguishing it from grassroots anti-UAE sentiment. This digital offensive aligns with the Taliban’s long-standing reliance on psychological operations, extending their influence without direct military confrontation.

The ramifications of this campaign extend far beyond social media vitriol. First, it seeks to erode the UAE’s and KSA’s religious legitimacy, particularly among conservative Muslim populations and transnational jihadist groups still active in Afghanistan. By casting these nations as apostates, the Taliban aims to fracture intra-Islamic solidarity, potentially driving recruitment for anti-Gulf militancy.

Second, the campaign reaffirms the Taliban’s commitment to asymmetric warfare. Despite their formal control of Afghanistan, the group continues to employ hybrid tactics, blending insurgency, propaganda, and diplomacy, to challenge adversaries indirectly. The digital domain offers a low-cost, high-impact arena to sustain pressure without provoking immediate military retaliation.

Most alarmingly, the explicit references to past IED tactics suggest a latent threat of physical escalation. While the Taliban may not directly orchestrate attacks on Gulf soil, the rhetoric could incite sympathizers or affiliate groups, such as Al-Qaeda in the Arabian Peninsula (AQAP), to act. The UAE and KSA, both vocal opponents of Islamist extremism, remain high-value targets for such elements.

To counter this evolving threat, a multi-faceted approach is essential:

• Gulf states should collaborate with international cybersecurity firms to identify and dismantle Taliban-linked networks, focusing on parody accounts and coordinated disinformation campaigns.
• Governments and religious institutions in the UAE and KSA must amplify moderate Islamic voices to delegitimize the Taliban’s extremist framing.
• Strengthening intelligence cooperation among Gulf nations and allies can pre-empt potential offline threats inspired by online incitement.
• Social media companies must enforce stricter verification processes to curb the proliferation of fake accounts disseminating violent propaganda.
• The international community should hold the Taliban accountable for digital incitement, linking sanctions relief to the cessation of hostile online campaigns.

“The internet is the first battlefield of the 21st century.” Wang Huning

The Taliban’s latest campaign exemplifies this reality, proving that in an interconnected world, ideological and physical conflicts are increasingly waged through pixels and propaganda. For the UAE and KSA, the challenge lies not only in defending their digital frontiers but in ensuring that online hostilities do not manifest in tangible violence. As the Taliban refines its hybrid warfare playbook, the global community must adapt, recognizing that the next threat may emerge not from a battlefield, but from a smartphone.

A distributor to the UK’s major supermarkets has said it is being held to ransom by cyber hackers.

Logistics firm Peter Green Chilled said it supplies supermarkets including Tesco, Sainsbury’s, and Aldi, but it is relatively small compared with larger UK food distributors.

It told BBC’s Wake Up to Money clients were “receiving regular updates” including “workarounds” on how to continue deliveries while one of its customers said thousands of their products could go to waste.

Recent major cyber-attacks on Marks & Spencer and Co-op were larger, but the attack highlights the challenges smaller logistics firms face, an industry source said.

In an email sent on Thursday, seen by the BBC, Peter Green Chilled said it had been the victim of a ransomware attack.

A ransomware attack is when hackers encrypt a victim’s data and lock them out of computer systems, demanding payment to hand back control.

The email said no orders would be processed on Thursday, although any order prepared on Wednesday would be sent.

Peter Green Chilled confirmed to the BBC the cyber attack happened on Wednesday evening but it said it was not in a position to discuss further.

“The transport activities of the business have continued unaffected throughout this incident,” its managing director Tom Binks said.

One of Peter Green Chilled’s customers, Black Farmer founder Wilfred Emmanuel-Jones, said he had “something like ten pallets worth of meat products” with Peter Green Chilled.

He said if those products don’t get to the retailers in time they will have to be “thrown in the bin”.

Ten pallets is “thousands and thousands of packs of products, sitting there, and the clock is ticking,” he said. “There’s no information. Everything along the chain has to be stopped, and then there are thousands of pounds worth of product that are just wasting away.”

Peter Green Chilled is a firm based near Shepton Mallet in Somerset that transports chilled food, mainly to regional stores.

There are much larger chilled food distributors in the UK – for example, Lineage, GXO, and Culina.

An industry source said these big firms, which distribute the largest volume of chilled food in the UK and internationally, have the resources to try to combat cyber attacks, while smaller firms may not.

However, Phil Pluck, chief executive of the Cold Chain Federation, said the warehousing, food storage and distribution sectors were “constantly under attack”.

A few years ago, there were a few cyber and ransomware attacks, but in the last year there has been “a huge increase”, he said.

About half of the food consumed in the UK “goes through the cold chain sector”, he said, so hackers “know how critical” distribution is for “putting food on supermarket shelves”.

He added that was “a really good lever to put the pressure on our companies to actually pay that ransomware”.

Mr Pluck said that he knew of at least ten attacks on member companies, but that firms like to keep attacks “under the radar”.

He said cyber attacks were “hugely underreported” in any sector “because once you’re attacked you lose control of your company” both through the attack and the mitigations by police and insurers.

Co-op narrowly avoided being locked out of its systems during an attack which exposed customer data and caused shortages of stock.

A ransomware group claimed responsibility for the attack on M&S which saw customer data stolen and empty shelves. The retailer itself said it had suffered a cyber attack.

Getty Images

What has been taken?

What should you do?

How did the hack happen?

M&S has issued a major cyber attack update revealing that customers information has been stolen.

The retail chain is still scrambling to keep stores running as the fallout continues.

1

In a statement posted on Instagram, M&S said: “As we continue to manage the current cyber incident, we have written to customers today to let them know that unfortunately, some personal customer information has been taken.

“Importantly, there is no evidence that the information has been shared and it does not include useable card or payment details, or account passwords, so there is no need for customers to take any action.

“To give customers extra peace of mind, they will be prompted to reset their password the next time they visit or log on to their M&S account and we have shared information on how to stay safe online.

“Everyone at M&S is working around the clock to get things back to normal for our customers as quickly as possible, and we are very sorry for any inconvenience they have experienced. Our stores remain open as they have throughout.

“Thank you for shopping with us and for your continued support, we are incredibly grateful.”