What 2025’s Major Cyber Incidents Taught Executives About Incident Response Readiness
Discover what Threat Detection, Investigation & Response (TDIR) means for modern enterprises, including frameworks, risks, and executive-level decision insights.
In 2025, many organizations discovered that incident response (IR) readiness is easier to document than to execute. On paper, response plans were approved, roles defined, and exercises completed. And yet, when incidents surfaced across organizations tied to platforms like Oracle and Salesforce, or within consumer-facing brands such as Jaguar and the Co-op Group, response friction became immediately visible.
Plans are based on a series of assumptions. Real events rarely unfold as neatly. Real incidents produce fragmented information, overlapping regulatory and communications pressures, and immediate business impact. Too often, decision latency, not attacker sophistication, became the dominant driver of damage.
This article examines what the cyberattacks of 2025 revealed about executive-level incident response readiness: why plans that look robust on paper failed in practice, and what leadership teams must rethink if they want readiness to translate into decisive action when the next incident hits.
Major Cyber Incidents of 2025 and What They Exposed
Oracle Cloud
In March 2025, Oracle Cloud was linked to a cyber incident involving its federated Single Sign-On (SSO) infrastructure, a shared identity layer used by Oracle Cloud customers. The incident came to light after a threat actor publicly claimed to have accessed and exfiltrated data tied to Oracle’s identity systems and began offering samples for verification.
According to reporting and third-party analysis, the attacker claimed to have accessed authentication-related systems rather than customer application workloads. The exposed data was associated with Oracle’s federated identity layer, which acts as a trust broker between Oracle Cloud services and customer identity providers.
Oracle initially stated that its core cloud infrastructure had not been breached. Subsequent disclosures indicated that Oracle privately acknowledged unauthorized access affecting older, legacy Oracle Cloud environments. These environments were still connected to live SSO workflows, meaning compromised components were part of active authentication paths despite not being part of Oracle’s modern cloud stack.
At a high level, the incident exposed:
- Scale: The threat actor claimed access to approximately 6 million records, with third-party analysis suggesting potential exposure across more than 140,000 Oracle Cloud tenants and millions of downstream users.
- Data involved: Reportedly exposed material included Java KeyStore (JKS) files, encrypted passwords and hashes, key files, and other authentication artifacts tied to identity services.
- Root cause: Evidence pointed to the exploitation of vulnerabilities in older Oracle Cloud components, potentially involving outdated Oracle Fusion Middleware instances still embedded in critical identity paths.
As details emerged, Oracle Cloud customers were left to assess exposure without immediate clarity as to which tenants were affected, whether credentials or keys had been misused, and how long access may have persisted. For many organizations, the immediate response focused on identity hygiene, such as credential rotation, federation review, and access audits, while definitive confirmation from the provider evolved.
Salesforce
In September 2025, a series of incidents involving Salesforce showed how a SaaS platform can become the focal point of a cyber crisis, even when the platform itself is not breached. In these cases, the absence of a platform-level compromise did little to limit business impact or reduce executive accountability once customer data exposure became a possibility.
The attacks did not target Salesforce infrastructure. Instead, threat actors gained access through customer-controlled environments, primarily by leveraging compromised user credentials, abused OAuth tokens, and over-privileged third-party integrations connected to Salesforce tenants. In several cases, access was established through previously authorized integrations that were rarely reviewed and had broad, persistent permissions.
Once inside, attackers operated as legitimate users. Their activity aligned closely with normal business behavior, allowing access to persist for extended periods without triggering immediate alerts.
Several factors made these incidents difficult to contain:
- Access looked normal. Activity originated from valid accounts and approved integrations, forcing security teams to manually distinguish malicious behavior from routine sales and customer service activity.
- Data exposure was immediate. Salesforce environments store customer records, sales pipelines, internal notes, forecasts, and executive reporting data -information tied directly to revenue, strategic planning, and regulatory obligations.
- Scope was unclear early on. Organizations struggled to determine how long access had existed, which objects were queried or exported, whether bulk data extraction occurred, and whether data had been staged for further misuse outside the platform.
Because Salesforce environments sit at the center of sales, customer service, and leadership reporting workflows, the business impact escalated quickly once unauthorized access was suspected or confirmed. In several cases, leadership teams faced pressure from legal, compliance, and communications stakeholders to assess disclosure obligations while investigations were still underway and attribution remained unresolved.
Jaguar
Jaguar suffered a cyber incident in August 2025 that disrupted internal IT systems supporting manufacturing and commercial operations, triggering a prolonged operational impact on the production process.
The incident involved unauthorized access to Jaguar’s internal IT environment, after which the company took multiple systems offline as a containment measure. These systems supported functions such as production planning, order management, and supplier coordination. While Jaguar did not disclose detailed technical specifics publicly, the disruption required broader system shutdowns, not just isolated remediation.
As a result, manufacturing schedules were interrupted, and downstream processes slowed. Even after systems were restored, Jaguar faced delays in resuming normal production and clearing operational backlogs, extending the impact beyond the initial incident window.
The business consequences became visible in Jaguar’s financial results. The carmaker reported a £485 million loss before tax and exceptional items, compared with a £398 million profit for the same period a year earlier. While multiple factors contributed to the result, the cyber incident was cited as a meaningful driver of disruption during the reporting period.
Several aspects of the incident shaped its severity:
- Containment required business shutdowns. Systems critical to manufacturing and logistics were deliberately taken offline to limit further impact.
- Operational recovery was non-linear. Restarting production required re-synchronizing systems, suppliers, and schedules, rather than simply restoring IT services.
- Impact outlasted the intrusion. Financial and operational effects continued after technical remediation was completed.
Co-op Group
In April 2025, the Co-op Group suffered a cyber incident that resulted in unauthorized access to customer data and disrupted its retail operations.
Attackers accessed systems linked to Co-op’s membership and customer data platforms, exposing personal information associated with millions of members. While Co-op did not release detailed technical indicators, the breach was publicly confirmed, triggering customer notifications and regulatory engagement. The data exposed was tied to identifiable individuals rather than anonymized or transactional records, increasing both legal and reputational risk.
Containment actions taken during the incident disrupted normal retail operations. Co-op reported issues across store availability, online services, and fulfillment, as systems were restricted or taken offline to prevent further access. These measures directly affected the company’s ability to trade during the response period.
The financial impact was significant. Co-op stated that the cyber attack resulted in approximately £206 million in lost sales, reflecting both immediate disruption and reduced trading while systems and customer services were stabilized.
Coinbase
In May 2025, Coinbase disclosed a cyber incident that stemmed from insider credential abuse, rather than a breach of its core trading or custody infrastructure. While no customer funds were stolen, the incident escalated rapidly due to the sensitivity of the data accessed and the attempted extortion that followed.
Attackers gained access by compromising the credentials of Coinbase employees and contractors, allowing them to interact with internal support and account management systems. Using this access, the attackers were able to retrieve personally identifiable information (PII) linked to customer accounts, including names, addresses, and contact details. Coinbase confirmed that approximately 70,000 customers were affected.
Although the attackers did not obtain private keys, passwords, or direct access to customer funds, the data accessed was sufficient to enable targeted phishing, social engineering, and follow-on fraud, increasing risk well beyond the initial intrusion.
After the access was detected, the attackers attempted to extort Coinbase, demanding payment in exchange for not releasing or abusing the stolen data. Coinbase refused to comply and instead took the unusual step of publicly offering a $20 million bounty for information leading to the identification and conviction of those responsible.
The incident was defined by the following factors:
- Access was internal and legitimate. The attackers operated using valid employee credentials, bypassing traditional breach indicators.
- Customer trust was immediately at stake. Even without financial theft, exposure of PII triggered notification obligations and public scrutiny.
- The response extended beyond containment. Executive involvement was required early to manage law enforcement coordination, customer communications, and the extortion attempt.
Common Executive-Level Failures Observed in 2025 Incidents
Across the major cyber incidents of 2025, the most consistent weaknesses did not appear at the technical layer. In most cases, security teams detected issues and escalated concerns appropriately. The breakdowns emerged once incidents required executive judgment.
What failed was not intent or effort, but the way decision-making structures performed under pressure.
Delayed Escalation and Authority Confusion
A recurring issue in the cyber attacks of 2025 was hesitation to escalate. Incident response plans defined notification paths, but they often stopped short of clearly assigning decision authority until an incident reached a material risk threshold.
As a result, incidents frequently remained in an interim state. Leadership teams waited for confirmation on scope, intent, or impact before triggering broader response actions. In parallel, legal, communications, and business stakeholders evaluated risk from different perspectives, each reasonably cautious about acting too early, creating friction at precisely the wrong moment. While teams worked to align, response timelines extended, operational impact increased, and external obligations accumulated.
Overreliance on Plans that Weren’t Tested
Another common failure was confidence in incident response plans that had never been exercised in conditions resembling a real event. There’s no doubt that many organizations affected by a cyber attack had well-documented playbooks, approved by leadership, and validated through reviews – and that during live incidents, those plans were referenced and followed. However, they assumed orderly progression, stable roles, and sufficient time to evaluate options.
In reality, executives were required to make decisions while facts were still incomplete and priorities conflicted. Plans designed for compliance and governance reviews provided limited support in these moments. One of the clearest lessons from cyber attacks in 2025 was that documentation alone does not prepare leadership for the realities of response.
What These 2025 Cyber Incidents Reveal About Readiness
Taken together, these major cyber incidents of 2025 highlight a gap between formal readiness and operational readiness at the executive level.
Readiness Gaps Exposed Under Real Pressure
Leadership teams struggled to align quickly across security, legal, communications, and business functions. Decision-making slowed as teams attempted to balance regulatory exposure, customer impact, and operational continuity. These challenges were not visible in planning exercises or audits, but became apparent during live response.
One of the more important executive lessons from past cyber attacks is that readiness must account for how leaders make decisions under uncertainty; not how processes are expected to work in theory.
Why Tabletop Exercises Didn’t Translate to Action
Tabletop exercises typically focus on validating the process: who is notified, which documents are used, and how escalation should proceed. Real incidents introduce variables that those exercises rarely test, such as ambiguous indicators, evolving third-party disclosures, media attention, and regulatory timelines.
As a result, leadership teams were familiar with the framework but unprepared for the pace and ambiguity of real response. The lessons learned from these cyber incidents in 2025 suggest that exercises must move beyond procedural validation and begin to test executive decision-making under realistic conditions.
Strategic Lessons for Executives After 2025
What Leadership Must Own Before the Next Incident
Executives cannot delegate incident response ownership and then step in only once consequences are unavoidable.
Before the next incident, leadership must decide explicitly who has the authority to:
- declare an incident when facts are incomplete
- approve actions that disrupt operations
- commit the organization externally
These decisions cannot be improvised during a live event. Ownership means agreeing ahead of time on how much uncertainty the organization is willing to tolerate, instead of waiting for clarity that may never come.
Aligning IR, Legal, Communications, and the Board
Most organizations already know who needs to be involved during an incident. The problem is how those groups interact when pressure is high.
Security teams prioritize containment. Legal teams assess exposure. Communications teams focus on consistency. Boards want to understand material risk. These perspectives are not in conflict, but without a shared decision framework, they compete for influence. The incidents showed that alignment cannot be achieved for the first time during a crisis. It has to exist beforehand: clear escalation triggers, shared assumptions about disclosure, and a common understanding of when business impact outweighs reputational or legal caution.
Turning Lessons Into Actionable Change
Updating Executive Playbooks
During real incidents, executives are asked to make decisions before scope is confirmed, often while legal, communications, and operational concerns compete for attention. Playbooks that assume orderly progression provide limited help in these moments.
More effective executive playbooks focus on a small number of practical issues:
- Clear decision authority – who can declare an incident, approve disruptive actions, and commit externally, without waiting for consensus.
- Early decision points – identifying where speed matters more than precision, such as system isolation or suspension of integrations.
- Pre-agreed actions – defining actions that can be taken immediately, without re-negotiation during a live incident.
Measuring Readiness Beyond Compliance
Readiness is often assessed by confirming that required elements exist: plans, exercises, and controls. The incidents showed that these indicators say little about how an organisation performs once an incident begins.
A more useful view of readiness looks at how leadership teams behave under pressure:
- How quickly executives align on a response direction
- Whether escalation happens before impact becomes obvious
- How effectively teams act in parallel rather than waiting for sequential approvals
These indicators are not captured in audits, but they directly influence outcomes. Reviewing decision timelines alongside technical response timelines provides a more accurate picture of preparedness.
How Executives Need to Rethink Incident Response in 2026
Looking ahead to 2026, incident response readiness will be judged less by how well it is documented and more by how quickly leadership can act when conditions are unclear. The incidents of the past year showed that uncertainty is no longer an edge case – it is the default state during the first and most consequential hours of a response.
For executives, this shifts the work away from refining plans and toward refining decision-making. Leadership teams need to be aligned in advance on who will lead during an incident, which decisions can be made without full consensus, and how much ambiguity the organization is willing to tolerate before acting.
Businesses that enter 2026 with clear authority, practiced executive coordination, and a realistic view of how incidents unfold will contain impact faster and recover with less disruption. Those who continue to equate readiness with documentation and exercises will find themselves relearning the same lessons: under pressure, in public, and at higher cost.
Rena Stern. (2026, February 15). What 2025’s Major Cyber Incidents Taught Executives About Incident Response Readiness, Sygnia.
https://sygnia-stg.prpl.global/blog/2025-cyber-incident-incident-response-lessons/
Related Resources
By clicking Subscribe, I agree to the use of my personal data in accordance with Sygnia Privacy Policy. Sygnia will not sell, trade, lease, or rent your personal data to third parties.