Last updated: 9 November 2026
In the UK Government’s Cyber Security Breaches Survey 2025/26, 43% of businesses (about 612,000) reported a breach or attack in the previous 12 months. Phishing was the most common type. These are only attacks organisations noticed, so the real picture is likely worse.
The headline figures
| Measure | Figure | Stated origin |
|---|---|---|
| Businesses breached or attacked, last 12 months | 43% (about 612,000) | Cyber Security Breaches Survey 2025/26 |
| Charities breached or attacked | 28% (about 57,000) | Cyber Security Breaches Survey 2025/26 |
| Businesses hit by phishing | 38% | Cyber Security Breaches Survey 2025/26 |
| Businesses hit by impersonation | 12% | Cyber Security Breaches Survey 2025/26 |
| Businesses hit by ransomware | 1% | Cyber Security Breaches Survey 2025/26 |
| Nationally significant incidents handled | 204 (up from 89), around four a week | NCSC Annual Review 2025 |
What the figures mean for you
Likely understated
The figures cover only attacks that organisations noticed and reported. Small firms with no monitoring may simply not see attacks.
People are the door
Phishing made up 93% of cyber crime against businesses, so staff awareness and email controls matter as much as firewalls.
Serious incidents rising
Overall breach rates are stable, but the NCSC handled 204 nationally significant incidents, up 130% on the previous year.
Basics going backwards
Among small businesses, a cyber risk assessment fell from 48% to 41%, a formal security policy from 59% to 52% and a cyber continuity plan from 53% to 44%.
What it costs
The median direct cost of the most disruptive breach was £0. However, the worst 5% of cases cost micro and small businesses £4,000 or more, and medium and large businesses £10,000 or more. That excludes lost time, clients and reputation. More firms now report lost revenue (5%, up from 2%) and reputational damage (3%, up from 1%).
How ABCOM helps
We review your IT and cyber security, show you where the gaps are and help close them. The source article points to a short list of actions: multi-factor authentication for email, Microsoft 365, banking and remote access; Cyber Essentials; verifying every bank detail change by phone on a number you already hold; regular staff training; tested backups kept separate from your main systems; and a simple incident plan. A vulnerability assessment shows what an attacker could find first, and our managed IT services keep the controls running.
Quick answers
What is the most common attack on UK businesses?
Phishing. It affected 38% of UK businesses in the Cyber Security Breaches Survey 2025/26, against 12% for impersonation and 1% for ransomware.
Are bigger firms attacked more than small ones?
The survey figures are higher for larger firms: 42% of micro, 46% of small, 65% of medium and 69% of large businesses. The source notes that bigger firms spot more attacks, and small firms with no monitoring may simply not see them.
How many UK businesses hold Cyber Essentials?
Only 5% do, rising to 12% of small businesses and 35% of large businesses. The same survey found 24% already have controls in all five areas.
Want to know how your business compares? Talk to ABCOM about a review of your IT and cyber security.
Related answers and guides
- UK Cyber Attack Statistics 2026 (ABCOM)
- How often should we patch?
- Deepfake, vishing and QR code phishing scams
- Vulnerability assessment
- ABCOM managed IT services
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.