I put together this guide on UK cyber attack statistics 2026 to help you see the real picture. Cyber crime is growing fast. More UK businesses get hit each year. These numbers come from the UK Government Cyber Security Breaches Survey and other trusted sources.
UK Cyber Attack Statistics 2026: Attack Rates
The latest data shows a clear trend. UK businesses face more attacks than ever.
43% of UK businesses faced a cyber attack in the past year.
That's about 612,000 businesses. Almost half of all UK firms got attacked. Small firms think they're safe. They're not.
I see this all the time in my work. Business owners say "we're too small to target". The data says otherwise. Hackers go after easy targets. Small businesses often have weak defences.
Key finding: Medium and large firms face even more attacks. 70% of large businesses reported attacks in the past year.
UK Cyber Attack Comparison: 2024 vs 2025
| Attack Type | 2024 | 2025 | Change |
|---|---|---|---|
| Phishing | 79% | 84% | +5% |
| Ransomware | 11% | 22% | +100% |
| Business Email Compromise | 18% | 23% | +28% |
| Supply Chain | 8% | 12% | +50% |
| Total Attacks | 39% | 43% | +10% |
Ransomware Threat Is Growing
Ransomware attacks doubled in 2025. This is the biggest threat I warn my clients about.
2x Ransomware attacks doubled compared to the previous year.
Ransomware locks your files. Hackers demand payment to unlock them. Many firms pay. Many never get their data back anyway.
The NCSC calls ransomware the top threat to UK businesses. I've helped firms recover from these attacks. It's not pretty. Read my guide on ransomware defence to learn more.
The Cost of a Data Breach
Cyber attacks cost money. A lot of money.
£27 billion Annual cost of cyber crime to the UK economy.
For a small business, the average breach costs £4,200. That's just the direct cost. It doesn't count lost time, lost customers, or damage to your name.
I've seen small firms go under after a bad breach. The cost goes beyond money. Trust is hard to rebuild.
- Direct costs: Fixing systems, paying experts, legal fees
- Downtime: Staff can't work, orders get lost
- Reputation: Customers lose trust and leave
- Fines: GDPR fines can reach millions
Common Attack Types
Most attacks use the same tricks. Here's what I see most often:
80% of data breaches involve weak or stolen passwords.
Weak passwords are the biggest problem. Most breaches start with a stolen login. Read about how hackers steal passwords.
- Fake emails: Scam emails trick staff into clicking bad links. AI phishing attacks are now 1,265% more common
- Stolen passwords: Hackers buy or guess login details
- Ransomware: Files get locked until you pay
- Supply chain attacks: Hackers get in through your suppliers. Learn about supply chain security
Use my password generator to make strong passwords. It's free and follows NCSC rules.
Who Gets Targeted Most
Some sectors face more attacks. But no business is safe.
- Finance: Banks and fintech firms hold valuable data
- Healthcare: Patient records fetch high prices
- Legal: Law firms hold sensitive client data
- SMEs: Small firms often have weak defences
I work with many SMEs. They think big firms are the only targets. The truth? Hackers love small businesses. Less security means easier access.
14% of UK businesses review their supplier security.
Only 14% of firms check their suppliers. This is a big gap. Hackers know this. They attack your weak link to get to you.
How to Protect Your Business
Good news: you can fix most risks. The Cyber Essentials 2026 changes address many of these threats. Here's what I tell every client:
- Get Cyber Essentials: This covers 80% of common attacks
- Train your staff: Most breaches start with human error
- Use strong passwords: Long and unique for each account
- Enable two-step login: A code on your phone stops most hackers. See my guide on MFA for Cyber Essentials
- Back up your data: Test your backups regularly
- Keep software updated: Patches fix known holes
Check my guide to Cyber Essentials for SMEs. It covers the basics well.
Many UK firms have common security gaps. Most are easy to fix. The key is knowing what to look for.
Quick win: Use my Cyber Essentials readiness check to see where you stand.
Frequently Asked Questions
Around 43% of UK businesses face cyber attacks each year. That's about 612,000 businesses. The rate is higher for medium and large firms.
Fake emails (phishing) are the most common attack. Hackers send scam emails to trick staff. They steal logins or install harmful software. About 80% of breaches involve weak or stolen passwords.
The average cost for a small business is £4,200. This covers direct costs like fixing systems and legal fees. The true cost is often higher when you add lost time, customers, and reputation damage.
Yes. Ransomware attacks doubled in 2025. The NCSC calls it the top threat to UK businesses. Hackers lock your files and demand payment. Many victims never get their data back even if they pay.
Cyber Essentials is a UK government scheme. It covers five basic security controls. These controls protect against 80% of common attacks. Many government contracts require it.
Yes. Small businesses often have weaker defences. Hackers know this. They use automated tools to find easy targets. Small doesn't mean safe. Every business with an internet connection is at risk.
Start with a risk assessment. This shows your weak spots. You can also use free tools like the Cyber Essentials readiness check. A security consultant can give you a full picture of your risks.
Need a Risk Assessment?
I help UK businesses find and fix their security gaps. Let's talk about your needs.
Get a Risk AssessmentThese UK cyber attack statistics 2026 show the threat is real. But you can protect your business. Start with the basics and build from there.
