Castlefield Stock Story

Recent attacks on M&S and the Co-op highlight the growing threat of cybercrime. David Gorman introduces NCC Group - held in our Thoughtful UK Smaller Companies fund - who are working hard to combat it.

“Arrests made after M&S, Co-op and Harrods cyberattacks” read a recent headline.(1) A swathe of UK firms, including Marks & Spencer, Harrods and the Co-op have already been attacked by cyber criminals in 2025, with M&S reportedly taking a £300m hit due to the disruption, not including the lost sales and reputational damage.

Meanwhile, the Co-op saw payments disrupted and shelves bare after its cyberattack. Hackers also allegedly stole Co-op members’ personal data, such as names and contact details. In May, Harrods had to restrict internet access across its websites following attempts to gain unauthorised access to its systems. These attacks hit close to home due to the household name status of the victims, although most cyberattacks are more low profile.

One of the many unhappy consequences of the pandemic was a big rise in cyberattacks due to the security vulnerability of remote working as well as the shift to things like the Cloud.

The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.(2)

One of the many unhappy consequences of the pandemic was a big rise in cyberattacks

So, what is cybercrime? It is characterised by “damage and destruction of data, stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems and reputational harm.”(3)

Cybercrime takes many forms - identity fraud, data theft, ransomware attacks, copyright infringement, and phishing campaigns are just some examples. Organisations consider the loss of personally identifiable information of customers or employees as one of the most dangerous outcomes of cyberattacks and the loss of sensitive information can have serious repercussions for victims.

The sector most targeted by cyber criminals is critical infrastructure, such as power grids or transport networks, followed by attacks on state institutions and then corporate targets. While governments have tried to tackle the problem, hacking is still too easy. The perpetrators of cybercrime range from the usual rogue nations through organised crime groups down to misguided individuals. Good cyber security is therefore a must-have for any organisation or individual.

The perpetrators of cybercrime range from the usual rogue nations through organised crime groups down to misguided individuals

One company fighting the good fight against cybercrime is Manchester-based NCC Group, a holding in our TM Castlefield Thoughtful UK Smaller Companies Fund. It operates through two divisions: Cyber Security and Escode (Software Escrow).

The Cyber Security division, accounting for 80% of total revenue, helps organisations reduce risk and build resilience through services such as penetration testing. By improving clients' cyber defences, NCC supports compliance with evolving regulations and helps build confidence in digital operations.

Escode, contributing the remaining 20% of revenue, is a global leader in software and source code escrow. This service ensures access to essential software even if a supplier fails, ensuring continuity for business-critical applications.

NCC is an active industry voice. Associate Director Kat Sommer (pictured below) leads on political engagement and this year gave evidence to Parliament’s Economic Security Sub-Committee on cyber resilience and public-private collaboration.

The company is at an important moment in its history. In April, the board announced a strategic review of Escode, including a potential sale of the Escrow business. Such a deal would sharpen NCC’s focus on Cyber Security and unlock capital for reinvestment or for shareholder returns. More recently, the board announced that it is also reviewing its options regarding the Cyber Security division. Of course, there is no certainty of a bid arising for either division, but it definitely makes life interesting.

Written by David Gorman

References:

Information is accurate as at 08.08.2025. Opinions constitute the fund manager’s judgement as of this date and are subject to change without warning. The officers, employees and agents of CIP may have positions in any securities mentioned herein. This material may not be distributed, published or reproduced in whole or in part. With investment, capital is at risk.

Castlefield Stock Story - NCC Group

Recent attacks on M&S and the Co-op highlight the growing threat of cybercrime. David Gorman introduces NCC Group - held in our Thoughtful UK Smaller Companies fund - who are working hard to combat it.

Nearly there...