Russian cyberattacks against UK are 'Putin Tax' costing $3.3 billion, says lawmaker

1. Executive summary

A report published 2026-10-07 by Labour MP Graeme Downie and postdoctoral researcher Dominic Reed, titled The Putin Tax, estimates the annual cost of Russian-linked hostile activity against the UK at £2 billion to £2.5 billion ($2.6 billion to $3.3 billion), a figure the authors describe as a floor. The report's central finding is not the number but the gap: parliamentary questions to several government departments found ministers hold no official estimate of the economic impact of Kremlin-linked incidents, and no cost analysis was done for the 2023 ransomware attacks on NHS software supplier Advanced or on Royal Mail. The attribution of those attacks to a group operating with the Kremlin's tacit consent, and in some cases with connections to Russian intelligence, is the report's own characterisation and is not corroborated by the verified reference data, which records no MITRE ATT&CK profile for the actor "Russian state"; treat it as unconfirmed. For EMEA financial services the item is strategic, not technical: it is a costing and disclosure argument, and it carries no new vulnerability, exploit or indicator set that changes a client's defensive posture today. The direct read-across is to incident-cost accounting and board-level reporting, where the same measurement gap the report identifies in UK government is likely to exist in firms' own hostile-state exposure estimates.

2. Regulatory framing

No other article in the regulatory reference is engaged. The item contains no third-party ICT contractual fact, no concentration-risk fact, and no testing fact, so DORA Art. 24, 28, 29 and 30 and NIS2 Art. 21(2)(d) are not triggered. UK NIS 2018 duties apply to UK OES and RDSP entities; this advisory is issued to EMEA financial services clients and the item does not identify a specific UK OES or RDSP incident, so no UK NIS row is claimed.

3. Technical analysis & attack chain

This is a strategic item. There is no attack chain to reconstruct: the source is a policy and costing report, and it names no exploited component, no CVE, no malware family, no command-and-control infrastructure and no indicator set. What follows is how the report's argument was constructed and what it does and does not establish.

1. Downie submitted a series of parliamentary questions to several government departments asking for estimates of the economic impact of incidents linked to the Kremlin.
2. The responses established that ministers held no such estimates.
3. The report's authors then built their own figure, and state that their methodology was limited.
4. The largest single component of the headline number was derived by assuming Russia is responsible for 10% of the £14.7 billion ($19.3 billion) the government says cybercrime costs British businesses annually. The report states this percentage was not based on a precise attribution.
5. The remaining components, including hostile activity threatening subsea cables, are also from models rather than public data.
6. The report recommends a national public awareness campaign on hostile-state threats and cyber resilience, annual publication of economic assessments of hostile foreign-state activity, that the National Cyber Security Centre include cost estimates alongside attribution in its reporting, and that the Ministry of Defence develop a methodology for costing physical hostile activity.

The two incidents the report cites as unmeasured are the ransomware attacks on NHS software supplier Advanced and on Royal Mail. The report attributes both to a group it says operates with the Kremlin's tacit consent and in some cases with connections to Russian intelligence. That attribution is the report's assertion; the verified reference data holds no MITRE ATT&CK profile for "Russian state", so the link between the Kremlin and either intrusion is unconfirmed. The report does not name the group, does not give a date for either attack beyond the Advanced and Royal Mail references, and does not describe the intrusion technique, the ransomware family, the initial access vector or the ransom demand in either case. Nothing in the source supports a technical reconstruction of either incident, and this advisory does not attempt one.

The report also references the August 2025 cyberattack on Jaguar Land Rover, estimated to have cost the British economy $2.5 billion, and notes the UK government has not formally attributed it to Russia-linked actors. It further references a 2024 arson attack on a London warehouse ordered by Russia's Wagner Group. The Jaguar Land Rover attribution is explicitly absent, and the arson item is a physical attack, not a cyber one; neither should be folded into a cyber threat model on the strength of this report.

Confidence caveat: the £2 billion to £2.5 billion figure, the 10% attribution assumption, the Advanced and Royal Mail attributions, and the Jaguar Land Rover cost estimate all rest on this single report and its underlying models. The authors themselves describe the methodology as limited and the figure as a floor. None of these numbers should be used in a client's own risk quantification without independent sourcing.

4. Mitigation & containment

There is no technical containment action arising from this item. The report describes no active intrusion, no exploited vulnerability and no infrastructure to block. The actions below address the measurement and reporting gap the report identifies, which is the only part of this item a financial services firm can act on.

P1 (within 24h)

• Confirm whether your current major-incident classification and regulatory reporting workflow records a cost figure, and whether the methodology behind that figure is documented. If a supervisory authority asked how the number was derived, the answer should exist in writing before the question is asked.
• Check whether your incident register distinguishes hostile-state-linked incidents from other cybercrime. If it does not, the cumulative exposure the report describes cannot be measured at firm level either.

P2 (within 72h)

• For any open or recently closed ransomware incident at a critical third-party supplier, confirm whether a cost estimate was produced and whether it covered business interruption, recovery labour and customer remediation, not just ransom demand. The report's finding is that these costs went unmeasured at national level; the same omission at firm level weakens both DORA Art. 18 classification and DORA Art. 19 reporting.
• Review board and risk-committee reporting for hostile-state exposure. If the reporting presents threat without cost, it repeats the gap the report criticises.

P3 (within 7 days)

• Where the firm relies on external cost benchmarks for cyber risk quantification, check whether those benchmarks separate state-linked activity from general cybercrime. The report's 10% assumption is a model input, not a measurement, and should not be adopted as a planning figure.
• Track the report's recommendations on NCSC cost reporting and annual government economic assessments. If adopted, they will become a public benchmark that supervisory expectations may converge on.

5. Indicators of compromise

No indicators of compromise available in the source material. The source names no hashes, domains, IP addresses, file paths, registry keys or command-line artefacts. No copyable indicator block is provided because there is nothing machine-pivotable to include.

The source does describe named incidents and actors without technical detail. These are not indicators and are recorded here only so the distinction is clear.

6. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named entities are victim organisations, a state actor and a physical-attack group, none of which are artefacts of a threat. A rule built on those names would detect reporting about the incidents, not the incidents themselves.

7. Sources

• The Record, "Russian cyberattacks against UK are 'Putin Tax' costing $3.3 billion, says lawmaker", https://therecord.media/russia-cyberattacks-on-britain-putin-tax-graeme-downie, published 2026-10-07.

This is the only source provided for this item. Every factual claim in this advisory traces to it, and the confidence caveats in §3 and §5 reflect that single-source basis.

8. Adverse Trace position

Adverse Trace assesses this as a strategic item with no operational severity for EMEA financial services clients: there is no CVE, no exploitation state, no malware and no indicator set, and the verified reference data records no MITRE ATT&CK profile for the actor "Russian state", so the Kremlin attribution the report relies on is unconfirmed and we do not carry it forward as established. The client impact is indirect and sits in incident-cost accounting and regulatory reporting: the report's finding that a national government holds no estimate of hostile-state economic impact is a prompt for firms to check whether their own DORA Art. 18 classification and Art. 19 reporting rest on a documented cost methodology or on an assumption. We will monitor whether the report's recommendations on NCSC cost reporting and annual government economic assessments are adopted, since adoption would create a public benchmark that supervisory expectations may follow, and we will revisit this advisory if a named group, intrusion technique or indicator set emerges from the Advanced, Royal Mail or Jaguar Land Rover incidents. Clients who want to act on this item should start with the P1 check in §4: confirm the cost methodology behind their last major-incident classification is written down.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.