M&S chair calls for mandatory reporting of cyber attacks after "traumatic" ransomware incident – but will it do more harm than good?

By Nicole Kobie for IT PRO
Friday, July 11, 2025

• 425
• More

In the UK, breaches of personal data must be reported to the Information Commissioner's Office, but there are no further requirements for hacking attacks that merely cause disruption or leak only corporate data. M&S said in May that some customer data was accessed in the incident.

More harm than good?

Not everyone agrees with Norman's call for mandatory reporting. Dr. Ilia Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS), said such a requirement could do more harm than good.

One challenge is properly defining what a "reportable attack" would include.

"For example, DDoS attacks may have a huge impact on business operations, but no confidential or regulated data is commonly stolen unless combined with other types of attacks," Kolochenko told ITPro.

"Moreover, DDoS attacks are complex and sometimes technically impossible to investigate. Thus, reporting them to authorities will bring from little to no value."

Beyond that, any reporting rule must include exemptions where alerting authorities would hinder an ongoing investigation, and bodies like the NCSC might need more funding to sort through the deluge of reports.

"Otherwise, we may simply hinder the work of governmental agencies, while failing to attain the underlying goal of the proposed legislation," he said. Read Full Article