Data

UK cyber breach statistics for businesses

Reviewed by the Apex broking team · Last reviewed 2026-10-30

43% of UK businesses, around 612,000, reported a cyber security breach or attack in the previous 12 months, according to the DSIT Cyber Security Breaches Survey 2025/2026. The figures below are taken from that survey and from the NCSC Annual Review 2025, with the edition named against each number.

Part of: Commercial insurance

Headline figures

The main source is the Cyber Security Breaches Survey 2025/2026, an official statistics release from the Department for Science, Innovation and Technology (DSIT) and the Home Office. It was published on 30 April 2026, with fieldwork from August to December 2025 covering 2,112 UK businesses and 1,085 UK registered charities. This edition follows the survey previously titled CSBS 2025, now labelled 2024/2025.

Figures checked 30 October 2026.

Breaches by business size

Larger organisations report more breaches, partly because they have more staff, systems and suppliers, and partly because they are better at spotting incidents. The CSBS 2025/2026 gives these rates for the previous 12 months:

Formal incident response plans follow the same pattern: 21% of micro businesses have one, against 57% of medium and 76% of large businesses. Because micro businesses make up the large majority of UK firms, the micro rate largely drives the national figure. Among charities, cyber crime rose with income: 10% of low-income, 18% of medium-income and 34% of high-income charities were victims, against 14% of all charities.

Most common types of attack

Phishing is, in the survey's words, "the most prevalent type of breach or attack by far". The CSBS 2025/2026 breakdown for businesses:

• Phishing: 38% of businesses and 25% of charities. Phishing made up 93% of cyber crimes against businesses.
• Impersonation (emails or messages pretending to be the business or its staff): 12% of businesses and 7% of charities.
• Ransomware: 1% of businesses, down from 3% in both 2024/2025 and 2023/2024.
• Cyber-facilitated fraud: 3% of businesses (around 43,000), with an estimated 130,000 fraud events across the business population.

Low ransomware prevalence does not mean low severity. A rare event can still be the most expensive one a firm faces, which is why ransomware response sits at the centre of most cyber policy wordings. For the payment side of fraud, see our UK business fraud statistics.

What breaches cost

The survey asks businesses for the perceived cost of their single most disruptive breach or attack. Typical costs are low, but the tail is long:

For cyber crime other than phishing, the median perceived cost was £250 including businesses reporting £0, or £750 excluding them. For cyber-facilitated fraud, the median was £110 including £0 costs, or £500 among businesses that recorded a cost. The charity median was also £0.

These are self-reported, perceived costs. Most breaches are blocked phishing emails that cost nothing, so medians say little about the cost of a serious incident. Forensic investigation, legal advice, data subject notification and lost trading are often not counted by the business at the time. Our breakdown of breach costs shows what those heads of loss look like.

Trend against previous years

• Overall breaches: business prevalence fell from 50% in 2023/2024 to 43% in 2024/2025, and stayed at 43% in 2025/2026.
• Phishing: 38% in 2025/2026, down from 42% in 2023/2024.
• Insurance: businesses with some form of cyber insurance went from 43% (2023/2024) to 45% (2024/2025) to 47% (2025/2026).
• Board responsibility: 31% of businesses have a board member responsible for cyber security, up from 27% in 2024/2025. Among large businesses it is 68%.
• Cyber Essentials: 5% of businesses hold it, up from 3% in 2024/2025. Prompted awareness of the scheme was 17%.

DSIT says there were no methodology changes between 2024/2025 and 2025/2026 apart from adding region to the business weighting, so year on year comparisons hold where questions stayed the same.

At national level, the NCSC Annual Review 2025 (covering 1 September 2024 to 31 August 2025) reported 429 incidents handled, of which 204 were nationally significant, up from 89, and 18 were highly significant.

Governance, supply chains and insurance take-up

Cyber security was a high priority for senior management in 72% of businesses, but formal controls lag behind. Only 15% of businesses reviewed cyber risks from immediate suppliers and 6% from their wider supply chain.

On insurance, the CSBS 2025/2026 shows that 47% of businesses and 35% of charities had some cyber cover. Most of that sits inside a wider policy (37% of businesses), and only 10% of businesses and 5% of charities had a standalone cyber policy. A cyber extension on a package or office policy can carry a much lower limit and narrower cover than a dedicated policy.

What this means for insurance

The data points to three practical questions. Whether any of these is covered depends on the policy wording, limits and conditions.

1. Is the cover standalone or an extension? With 37% of businesses relying on cover inside a wider policy, it is worth checking the sub-limit for incident response, business interruption and ransomware. Our commercial cyber insurance guide explains the difference, and first party versus third party cyber cover sets out the two halves of a policy.
2. Is the limit sized for the tail, not the median? A median of £0 tells you little about a serious incident. Ransomware may fall across several policies, as covered in ransomware: cyber vs property vs BI.
3. Who pays when phishing becomes a payment loss? Many cyber policies treat funds transferred after a spoofed email differently from data breach costs, and some require a crime or social engineering extension. See social engineering and fund transfer fraud and commercial crime insurance.

Cyber insurance is not generally compulsory in the UK, although contracts and clients may require it; see is cyber insurance a legal requirement. Supplier risk, which so few businesses review, is covered in supply chain cyber and multiple policies. Professional firms should also read where cyber and PI cover begin and end. More guides sit in our cyber insurance hub.

How Apex uses this

Apex arranges cyber and crime cover for UK businesses. A broker can review whether your cyber protection is standalone or an extension, and whether the limits and sub-limits for ransomware, business interruption and payment fraud fit the risks shown in this data. Start from our commercial insurance page.

Sources

• DSIT and Home Office: Cyber security breaches survey 2025/2026 (published 30 April 2026)
• GOV.UK: Cyber Security Breaches Survey collection
• NCSC: UK experiencing four nationally significant cyber attacks every week (Annual Review 2025, 14 October 2025)

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.