NatWest Faces 100 Million Cyber Attacks Each Month, MSPs Told

NatWest Bank is targeted by around 100 million cyber attacks every month, according to the bank’s head of cybersecurity, Chris Ulliott. He gave evidence this week to Holyrood’s Criminal Justice Committee, highlighting the growing threat of digital crime in the UK.

Ulliott said NatWest blocks millions of suspicious emails every month, with about one-third of all incoming emails being rejected due to suspected malicious content. “We analyse every single email coming into our estate,” he said. “Millions a month are blocked because they are believed to be the start of an attack.”

The bank’s cybersecurity team includes hundreds of staff and has a multi-million-pound budget. Ulliott warned that cyber criminals are increasingly using artificial intelligence (AI) to improve the credibility of their scams. He said AI can be used to disguise fraudsters’ identities, including changing their appearance during online calls.

He also mentioned Scattered Spider, a group linked to a recent cyber attack on Marks & Spencer. He described the group as a loose international network of young people who exchange hacking techniques on online forums.

The committee also heard from Police Scotland, which reported a sharp rise in cybercrime—from 7,710 cases in 2020 to 18,280 in 2024. Assistant Chief Constable Stuart Houston said law enforcement agencies worldwide, including the FBI, are working together to tackle cybercrime, particularly fraud and ransomware operations.

SNP MSP Rona Mackay described the figures as “absolutely staggering,” while her colleague Ben Macpherson called cybercrime “the criminal justice issue of our time.” Macpherson also revealed that cybercriminals had impersonated him in attempts to contact his constituents.

David Keenan, chief information officer at car retailer Arnold Clark, recounted how a serious cyber attack in 2022 crippled the company’s network for months, despite having a dedicated team of 12 cybersecurity staff.

Adam Stachura from Age Scotland added that cybercrime can have devastating effects on elderly victims, many of whom struggle with digital technology. “It can create financial destitution and damage confidence and self-worth,” he said.

The committee's session underlined the increasing threat of cybercrime across all sectors and the urgent need for stronger defences and public awareness.