UK Cyber Crime Statistics 2026
The latest data on cyber attacks, data breaches, and their cost to UK businesses. Updated August 2026.
Sources: DCMS Cyber Security Breaches Survey, IBM Cost of a Data Breach Report, Verizon DBIR, ICO, NCSC.
50%
of UK businesses reported experiencing a cyber security breach or attack in the past 12 months.
DCMS Cyber Security Breaches Survey 2025
$4.88M
is the global average cost of a data breach in 2024, a 10% increase over the prior year and the highest total ever recorded.
IBM Cost of a Data Breach Report 2024
£3.4B
estimated annual cost of cyber crime to UK businesses, including direct losses, recovery costs, and operational disruption.
UK Government / NCSC estimates
Frequency of Attacks
How often UK businesses are being targeted — and how many don't even know it's happening.
cyber crimes were experienced by UK businesses in the 12 months covered by the 2024 DCMS survey, across all business sizes.
DCMS Cyber Security Breaches Survey 2024
of businesses that identified a breach or attack said phishing was the attack type — making it by far the most common vector.
DCMS Cyber Security Breaches Survey 2024
of UK charities also reported a cyber breach or attack in the past 12 months, showing it's not just a corporate problem.
DCMS Cyber Security Breaches Survey 2024
businesses that identified an attack experienced a negative outcome such as loss of money, data, or other assets.
DCMS Cyber Security Breaches Survey 2024
Cost of Cyber Crime
What breaches actually cost businesses — beyond just the ransom or the fine.
average total cost of a data breach globally. This includes detection, notification, response, and lost business costs.
IBM Cost of a Data Breach Report 2024
average cost of the single most disruptive breach for medium and large UK businesses. For small businesses, the average is lower but often more damaging relative to revenue.
DCMS Cyber Security Breaches Survey 2024
average time to identify and contain a data breach globally. Breaches involving stolen credentials took even longer — 292 days on average.
IBM Cost of a Data Breach Report 2024
average savings for organisations that extensively use security AI and automation compared to those that don't.
IBM Cost of a Data Breach Report 2024
Small Business Impact
Small businesses aren't too small to be targeted — they're often easier targets.
of cyber attacks globally target small businesses, yet only 14% are prepared to defend themselves.
Accenture / Verizon DBIR
of small businesses that suffer a significant cyber attack go out of business within six months.
US National Cyber Security Alliance
of UK small businesses (10–49 employees) have identified a cyber breach or attack in the past 12 months.
DCMS Cyber Security Breaches Survey 2024
of UK businesses have a formal incident response plan. The majority have no documented process for handling a breach.
DCMS Cyber Security Breaches Survey 2024
Types of Attack
What the attacks actually look like — and where most businesses are exposed.
of breaches involved phishing attacks — fake emails impersonating trusted contacts, suppliers, or platforms.
DCMS Cyber Security Breaches Survey 2024
of breaches involved impersonation of the organisation in emails or online — domain spoofing, CEO fraud, and invoice redirection.
DCMS Cyber Security Breaches Survey 2024
of breaches globally involved a human element — social engineering, errors, or misuse of credentials.
Verizon 2024 Data Breach Investigations Report
of breaches involved a third party — supply chain attacks, partner integrations, or software vulnerabilities in vendor products.
Verizon 2024 Data Breach Investigations Report
UK Regulatory & Reporting
What's happening at the enforcement level — ICO actions and reporting trends.
personal data breaches were reported to the ICO in 2023/24, with the health, education, and finance sectors reporting the most incidents.
ICO Annual Report 2023/24
total fines issued by the ICO in 2023/24 for GDPR and data protection violations. Individual fines have reached up to £12.7 million in previous years.
ICO Enforcement Actions
is the maximum time a UK organisation has to report a notifiable data breach to the ICO under UK GDPR. Many businesses don't have the processes in place to meet this deadline.
UK GDPR / ICO Guidance
of UK businesses have a formal cyber security strategy. The rest are operating reactively, without documented policies or procedures.
DCMS Cyber Security Breaches Survey 2024
What This Means for Small Businesses
The data is clear: cyber attacks are not just a big-business problem. Nearly half of all attacks target small businesses, and the majority of UK SMEs don't have a formal security strategy or incident response plan.
The good news is that most attacks exploit basic weaknesses — no MFA, no email authentication, no device management, poor password practices. These are all fixable without enterprise budgets. Tools like Microsoft Defender, Conditional Access, and Intune are included in Microsoft 365 Business Premium and provide genuine protection when configured properly.
If you're a small business owner reading these statistics and wondering where you stand, we offer a free security review that checks your email domain, identity policies, device security, and backup status. No commitment, no sales pitch — just a clear picture of what's working and what's exposed.
Sources & Methodology
Statistics on this page are compiled from publicly available reports including the DCMS Cyber Security Breaches Survey (2024 & 2025), IBM Cost of a Data Breach Report 2024, Verizon 2024 Data Breach Investigations Report (DBIR), ICO Annual Reports, NCSC Annual Reviews, and other cited sources.
Where UK-specific data is not available, global figures are used and clearly labelled. All statistics are attributed to their original source. This page was last reviewed and updated in August 2026.
Don't be a statistic.
Find out where your business is exposed with a free security review.