Would the Cyber Security and Resilience Bill have changed these attacks?
In some cases, probably. On our reading, the Cyber Security and Resilience Bill (CSRB) speaks most directly to supplier incidents like Synnovis and Advanced, but retail and manufacturing attacks like M&S, Co-op and Jaguar Land Rover would mostly fall outside it. These are our assessments, made with hindsight.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to read this page
These assessments test the Cyber Security and Resilience Bill (CSRB) against public reports of real incidents. The Bill was not law at the time, so nothing here suggests any company breached it. The "our reading" columns are our interpretation, not findings by a regulator or the companies involved. Public accounts may also be incomplete.
Summary
| Incident | Public impact | Likely Bill route (our reading) | Would the Bill speak to it? |
|---|---|---|---|
| Synnovis, June 2024 | London hospital services disrupted | Possible critical supplier | Yes, directly |
| Advanced, August 2022 | NHS 111 and other health services disrupted | Depends on how its services are classified | Probably, in part |
| M&S and Co-op, 2025 | £270m to £440m estimated combined cost | Retail not listed | Mostly no |
| Jaguar Land Rover, 2025 | About £1.9bn estimated UK cost | Manufacturing not listed | Mostly no |
Synnovis: a supplier that hospitals depended on
Synnovis, a pathology partnership, was hit by ransomware on 3 June 2024. NHS England's London figures later put the disruption at 1,134 planned operations and 2,194 outpatient appointments postponed. Blood matching was disrupted, and hospitals used O-type blood for patients who could not wait.
Our reading: this is the kind of dependency the critical supplier power addresses. A regulator would have to find direct supply to a regulated operator, significant potential impact, and consider how readily the service could be replaced. The government uses this incident as a case study in its factsheet, without saying Synnovis would be designated.
Lesson: map suppliers that you could not replace within days, even when they aren't IT companies.
Advanced: when the supplier is also the data processor
A 2022 ransomware attack on Advanced Computer Software Group disrupted NHS 111 and other health services. In March 2025 the ICO fined the company £3.07 million as a data processor, the provisional figure having been about £6 million. Reports point to gaps in multi-factor authentication, and the ICO credited the company's engagement with the NCSC, National Crime Agency and NHS.
Our reading: a similar provider could become an RMSP, an RDSP or a critical supplier, depending on the services involved. It would then face 24-hour and 72-hour notifications and customer notice duties, on top of data protection law.
Lesson: check multi-factor authentication on every remote access route, starting with supplier and admin access.
M&S and Co-op: a large gap, by design
The Cyber Monitoring Centre rated these 2025 attacks a Category 2 event and estimated their combined cost at £270 million to £440 million.
Our reading: retail is not an essential service, so the Bill would not generally have regulated these businesses as retailers. Their suppliers might have been regulated, and any regulated supplier would have had its own duties. See our retail page.
Lesson: being outside the regime does not reduce your exposure. Critics of the Bill have made the same point about its scope.
Jaguar Land Rover: national impact from an unregulated sector
The Cyber Monitoring Centre called this the most economically damaging cyber event to hit the UK, at about £1.9 billion, with a range of £1.6 billion to £2.1 billion, and reported around 5,000 affected businesses.
Our reading: manufacturing is not a listed sector. The Bill does let ministers specify further essential activities by regulations, after consultation, if essential to the economy or day-to-day functioning of society. The text doesn't name any future additions. See our manufacturing page.
Lesson: ask what your supply chain would do if your largest customer stopped ordering, or stopped paying, for a month.
What the cases have in common
- Dependency matters more than sector. The worst effects often appeared in organisations that were not attacked directly.
- Recovery takes longer than plans assume. Test recovery of the systems the business truly depends on.
- Reporting is the start. A 24-hour notice doesn't restore a service, so continuity plans need equal attention.
Sources
- NHS England: Synnovis ransomware cyber-attack
- Government factsheet: designating critical suppliers
- Tech Monitor: ICO fines Advanced £3.07m
- Computer Weekly: Cyber Monitoring Centre estimate of the Jaguar Land Rover attack
- ITPro: experts on the scope of the Bill
- The Bill as brought from the Commons (HL Bill 32)
Frequently asked questions
The government uses the Synnovis attack as a case study of supplier risk, but its factsheet does not say Synnovis would be designated. Any decision would be for a regulator applying the legal tests.
Nobody can say that. The Bill sets duties on security, reporting and customer notification, but no law can guarantee an attack will not succeed.
On our reading, not simply as a retailer or a car maker, because neither sector is on the essential services list. Particular group companies might fit another route, which we have not assessed.
No. The Bill was not in force at the time of these incidents, and this page does not suggest any company has breached it.