Why Cyber Security Awareness Month matters
October marks National Cyber Security Awareness Month, providing an opportunity to review some of the past year’s most significant incidents and consider how we can better prepare for the inevitable. When people hear “data breach”, they often picture a single weak password or an unlucky employee clicking a link. Although this can and does happen, as we’ll talk about later in this article, the past 12 months tell a more structural story.
The largest incidents have spread through cloud platforms, overly concentrated privileged data and over reliance on third parties, allowing one compromise to affect millions of people and many organisations at once. At the same time, attackers are using artificial intelligence to move faster, exploit vulnerabilities sooner and make social engineering more convincing.
This review covers publicly disclosed incidents from roughly September 2025 to September 2026
Jaguar Land Rover: operational shutdown and supply-chain disruption
Jaguar Land Rover (JLR) disclosed the cyber incident on 2nd September 2025 after proactively shutting down systems to contain it. The action severely disrupted global retail and manufacturing operations, and the interruption spread through an automotive supply chain in which smaller businesses depend on JLR’s production schedules.
The company later confirmed that some data had been affected, although it did not publicly provide a detailed breakdown of the information or the initial access method.
By 29th September, JLR said a controlled, phased restart was under way, with parts of manufacturing due to resume. The case demonstrates that the cost of a cyber incident is not limited to stolen data; loss of production, unavailable applications, delayed orders and supplier distress can quickly become the dominant impacts. It also shows why manufacturers need tested manual processes, recovery priorities for operational technology and visibility of critical dependencies beyond their immediate suppliers, often contained within Business Continuity and Disaster Recovery Plans.
University of Nottingham: student-record system breach and large-scale data exposure
The University of Nottingham identified unauthorised activity in its Campus Solutions student record platform on 9th June 2026 and immediately took the affected systems offline. The university confirmed that an external third party had accessed a significant amount of data relating to current students and alumni. It reported the incident to the Information Commissioner’s Office, Action Fraud and the Office for Students, while continuing a forensic investigation with the third party that maintains the platform.
The incident highlights the risks associated with concentrating sensitive information within a single system. It also demonstrates the importance of rapidly isolating affected services, understanding supplier dependencies and communicating clearly with people whose information may have been compromised.
Police National Legal Database: contact information published on the dark web
In July 2026, the Police National Legal Database identified a data-security incident in which names, organisations and work email addresses belonging to police officers, police staff, criminal-justice professionals, government partners and customers were compromised and published on the dark web.
Some names and email addresses submitted through the Ask the Police service were also affected. PNLD stated that it had found no evidence that passwords or other security credentials were compromised and clarified that it does not hold confidential information about victims, witnesses or offenders. The case demonstrates how apparently limited contact data can still support convincing targeted phishing and impersonation attempts, particularly when it identifies people working in trusted or privileged roles.
Taken together, these incidents show that cyber resilience depends on more than preventing an initial intrusion. Organisations must also be able to contain disruption, manage third-party exposure, communicate with affected stakeholders and recover critical services under pressure. The following measures address the recurring weaknesses demonstrated by these cases.
What organisations should do now
- Prioritise exploitable vulnerabilities. Use threat intelligence and the CISA Known Exploited Vulnerabilities catalogue to drive emergency patching, especially for internet-facing systems.
- Strengthen role-based training and controls. Move high-risk users towards phishing resistant authentication and training, restrict account recovery and privileged access, and monitor unusual sign-ins.
- Map critical suppliers and data flows. Identify concentration and fourth party dependencies, require prompt incident reporting, and test how the organisation would operate if a major provider became unavailable.
- Prepare for extortion, not only encryption. Maintain isolated, tested backups, rehearse decision-making, preserve logs and define legal, communications and regulatory responsibilities before an incident.
- Govern AI use. Approve tools, protect sensitive prompts and training data, validate models and packages, and include AI systems in secure development and supplier assurance processes.
Conclusion
The most significant breaches of the past year were not isolated technical failures. They exposed the consequences of digital concentration, delayed remediation and reliance on complex supply chains.
The rapid development of artificial intelligence is likely to make familiar attacks faster, cheaper and more persuasive, while making the next threat increasingly difficult to predict.
Organisations should therefore focus on resilience; establishing tested plans and procedures, protecting critical services and preparing to respond decisively when an incident occurs. These measures can reduce disruption and help safeguard the data entrusted to them by customers, employees and other stakeholders.