How many UK businesses get hacked, which attacks work, what it costs, and what a penetration tester would fix first. Official figures from the Government Cyber Security Breaches Survey 2025/26 and the NCSC Annual Review 2025, in plain English.
The numbers at a glance
What the latest official UK figures say about businesses and charities. These are only the attacks organisations noticed and reported, so the real picture is likely worse.
UK businesses breached or attacked
In the last 12 months, about 612,000 businesses. Down from 50% in 2023/24.
UK charities breached or attacked
About 57,000 charities in the last 12 months.
Serious incidents, year on year
The NCSC handled 204 nationally significant incidents (Sept 2024 to Aug 2025), up from 89. That is around four a week.
of cyber crime was phishing
19% of businesses (about 267,000) were victims of cyber crime.
businesses lost money to fraud
Cyber-facilitated fraud, an estimated 130,000 fraud events in a year.
hold Cyber Essentials
12% of small businesses and 35% of large businesses, yet 24% already have controls in all five areas.
What attackers actually use
Share of UK businesses hit by each type in the last 12 months. The door is almost always a person, not a firewall.
By attack type
Phishing was the most disruptive attack for 69% of breached businesses. 51% now report phishing as their only attack type.
Breached or attacked, by business size
Bigger firms spot more attacks. Small firms with no monitoring may simply not see them.
How a typical phishing attack plays out
An illustrative path, the kind a penetration tester tries to break before a criminal does. It is a simplified model, not a statistic.
Every step has a control that breaks it: staff awareness, MFA, conditional access, monitoring and tested backups. See how ABCOM tests and hardens these defences.
What it costs, and where small firms are slipping
Direct cost of the most disruptive breach
The median direct cost. But the worst 5% cost £4,000 or more for micro and small firms and £10,000 or more for medium and large firms. That excludes lost time, clients and reputation. More firms now report lost revenue (5%, up from 2%) and reputational damage (3%, up from 1%).
Small businesses: basics going backwards
Also: 47% of businesses have cyber insurance (55% of small ones) and 31% have a board member responsible for cyber.
AI is changing the threat
Criminals use AI to write phishing emails, clone voices and impersonate directors, while many businesses are slow to manage their own AI use.
using or considering AI
Only 24% of those have security practices to manage the risks.
of UK employees used unapproved AI tools
So-called shadow AI, per Microsoft research. Take the Shadow AI Check.
Safe AI use
Our AI and Copilot FAQs and AI Readiness Sprint explain how to use AI safely.
What these statistics mean for your business
The numbers point to a short list of actions that stop most real-world attacks:
- Turn on multi-factor authentication (MFA) for email, Microsoft 365, banking and remote access. It stops most phishing-led account takeovers.
- Get Cyber Essentials. Certified organisations were 92% less likely to make an insurance claim, and eligible firms get up to £25,000 of cyber insurance included.
- Verify every bank detail change by phone, on a number you already hold.
- Train your people regularly, with short phishing simulations.
- Keep tested backups separate from your main systems.
- Write a simple incident plan and an AI policy. Our Small Business Guide to Cyber Security walks through both.
Get UK cyber threat updates and news
Join our mailing list for new statistics, scam warnings and practical security advice for UK businesses. No spam, unsubscribe any time.
Frequently asked questions
How many UK businesses suffered a cyber attack in 2026?
According to the UK Government’s Cyber Security Breaches Survey 2025/26, 43% of UK businesses (about 612,000) and 28% of charities identified a cyber security breach or attack in the previous 12 months.
What is the most common type of cyber attack in the UK?
Phishing. It affected 38% of UK businesses and made up 93% of cyber crime against businesses. Impersonation affected 12% and ransomware 1%.
How much does a cyber attack cost a UK small business?
The median direct cost of the most disruptive breach was £0, but the worst 5% of cases cost micro and small businesses £4,000 or more, and medium and large businesses £10,000 or more, before lost time, clients and reputational damage.
Are cyber attacks on UK businesses increasing?
Overall breach rates are stable at 43% of businesses, but serious incidents are rising sharply. The NCSC handled 204 nationally significant incidents in 2024/25, up 130%, or around four a week.
How many UK businesses have Cyber Essentials?
Only 5% of UK businesses hold Cyber Essentials, rising to 12% of small businesses and 35% of large businesses, even though 24% of businesses already have controls in all five areas.
Want to know how your business compares?
Our Burgess Hill team can review your IT and cyber security, show you where the gaps are, and help you get Cyber Essentials. NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials), supporting Sussex businesses since 1996.
- UK Government: Cyber Security Breaches Survey 2025/2026
- NCSC Annual Review 2025: incident management
- Microsoft UK: Rise in shadow AI tools
Figures are as published by the sources above. The attack path is an illustrative model.
Do not just read it. Act on it.
Reading is the easy part. Book a free IT review and we will tell you, in plain English, where your business stands and what to fix first.