Nearly half of UK businesses are getting hit. The government’s own numbers, published by the Department for Science, Innovation and Technology (DSIT) in April 2026, show that 43% of UK businesses identified a cyber security breach or attack in the past 12 months, according to the Cyber Security Breaches Survey 2025/26. The prior edition of that same survey, published by GOV.UK in April 2025, already put the raw scale of the problem in stark terms: an estimated 612,000 UK businesses reported a breach or attack, absorbing roughly 8.58 million individual cybercrimes between them. A separate industry survey pushes that figure even higher for smaller firms. Security researchers at ESET found that 49% of 500 surveyed UK small and medium-sized businesses had experienced a cyber incident in the same period, per reporting picked up by Windows Forum in mid-September 2026. Two different surveys, two different methodologies, but the same uncomfortable conclusion: for a UK business today, a cyber incident is closer to a coin flip than a rare event.
The story matters because the 43% headline isn’t new noise, it’s a stall. That number is flat versus last year, and it follows a drop from 50% in 2023/24. Attackers haven’t backed off. Businesses have plugged some holes, but phishing keeps finding new ones, and the gap between big companies with dedicated security teams and small firms running lean is widening fast. This piece breaks down what the data actually says, who’s most exposed, what the government and named cybersecurity firms recommend, and what happens next as the 2026/27 edition of the survey gets underway.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the Cyber Security Breaches Survey 2026 Actually Found
The Cyber Security Breaches Survey is DSIT’s annual official statistics release, and it remains the single most cited dataset on UK cyber security breaches. For the 2025/26 reporting period, 43% of businesses and 28% of charities said they had identified a breach or attack in the previous 12 months, according to the published survey results. That business figure is unchanged from 2024/25, breaking a run of year-over-year improvement and suggesting that whatever progress UK firms made in cutting breach rates through 2023 and 2024 has leveled off.
Breach rates aren’t evenly spread. Micro businesses, those with one to nine employees, reported a 42% breach rate. Small businesses with 10 to 49 staff came in at 46%. The number jumps sharply for medium-sized firms (50-249 employees) at 65%, and again for large organizations with 250 or more employees at 69%, according to the survey’s size breakdown. That’s not a small gap. Large firms are more than 60% more likely to report a breach than micro businesses, and the pattern has held across multiple survey cycles.
That size gradient tells a story about visibility rather than just risk. Larger organizations run monitoring tools, security operations functions, and formal incident logging, so they catch and report more of what happens to them. Smaller firms often lack the tooling to detect an intrusion in the first place, which means the “true” breach rate for micro and small businesses is likely underreported rather than genuinely lower. DSIT’s own technical notes acknowledge that smaller organizations identify fewer phishing attempts partly because of weaker detection capability, not because they’re being targeted less.
Phishing Is Still the Dominant Threat, by a Wide Margin
If there’s one attack type driving this whole story, it’s phishing. The government survey found that 38% of all UK businesses reported experiencing phishing in the past year, making it the most common attack type by a wide margin, though the figure has moved around recently: the prior 2024/25 edition, published by GOV.UK in April 2025, recorded phishing incidence at 37%, itself down from 42% the year before that. Among businesses that identified any breach or attack, 69% said phishing was their most disruptive incident type, and 51% of breached businesses experienced phishing exclusively, with no other attack type reported alongside it.
Ransomware, by contrast, looks almost rare in the same dataset. Roughly 1% of UK businesses reported a ransomware incident in the latest survey, down from the 3% recorded in the 2024/25 edition, which GOV.UK published in April 2025. That doesn’t mean ransomware isn’t dangerous, it remains one of the most financially destructive categories when it does hit, but it confirms that volume-wise, phishing dwarfs every other attack vector combined. For most UK businesses, the practical cyber security problem in 2026 isn’t a sophisticated ransomware gang, it’s an employee clicking a convincing email.
This lines up with how attackers actually allocate effort. Phishing is cheap to run at scale, requires no exploit development, and works because it targets people rather than systems. A firm can patch every server it owns and still get breached because someone opened an attachment. That’s part of why every major UK cyber authority, including the National Cyber Security Centre (NCSC), keeps staff phishing awareness at the top of its guidance list rather than treating it as a solved problem.
Breach Rate by Business Size: The Data Table
Here’s the size breakdown from the DSIT survey in full, current as of the April 2026 release of the Cyber Security Breaches Survey 2025/26, which confirmed large businesses (250+ employees) holding at a 69% breach rate, alongside the phishing exposure context that runs through nearly every incident category.
| Business Size | Employees | Breach/Attack Rate (2025/26) | Most Common Attack Type |
|---|---|---|---|
| Micro business | 1-9 | 42% | Phishing |
| Small business | 10-49 | 46% | Phishing |
| Medium business | 50-249 | 65% | Phishing |
| Large business | 250+ | 69% | Phishing |
| All UK businesses (average) | All sizes | 43% | Phishing (38% overall) |
| Charities | All sizes | 28% | Phishing |
The pattern is consistent across every recent edition of the survey: bigger organizations report more breaches, phishing leads every category, and charities sit meaningfully below businesses, likely reflecting a mix of lower attacker interest and, again, weaker detection.
What a Breach Actually Costs UK Businesses
The cost figures in the official survey look deceptively small at first glance, and that’s worth unpacking. The median perceived cost of the most disruptive breach, across all businesses surveyed including those with zero recorded loss, was £0. That’s not a typo. Most reported incidents produced no measurable financial outcome, largely because many were low-severity phishing attempts that got blocked or ignored before causing damage.
The picture changes once you isolate businesses that actually reported a financial outcome. Among that subset, the median perceived cost of the most disruptive breach was about £560, according to the government’s technical report. At the top end, medium and large businesses that reported a cost saw a 95th-percentile figure of roughly £10,000. Separate industry analysis of the same underlying government data, cited by DeepStrike, put the average cost of a single most disruptive breach at approximately £3,550 among affected businesses, or about £1,600 when businesses reporting no cost are folded back in. The same analysis estimated the average annual cost of cybercrime at £990 per affected business, rising to £1,970 once phishing-only cases are excluded from the calculation.
Those numbers matter because they show cost is lumpy, not average. Most businesses lose little or nothing to a given incident. A smaller number lose a lot, and it’s that long tail, the ransomware case, the wire fraud, the week of downtime, that drives up the averages while median figures stay low. For a small business owner reading a £0 median statistic and concluding cyber security isn’t worth the spend, the 95th-percentile £10,000 figure is the number that should actually change the calculation.
Cost of a Breach, By the Numbers
| Cost Measure | Figure | Population Measured |
|---|---|---|
| Median cost, all businesses | £0 | All survey respondents |
| Median cost, businesses reporting an outcome | £560 | Businesses with a recorded financial loss |
| 95th-percentile cost, medium/large businesses | ~£10,000 | Medium and large businesses reporting a cost |
| Average cost per affected business (industry estimate) | ~£3,550 | Affected businesses only |
| Average cost including zero-cost incidents (industry estimate) | ~£1,600 | All affected businesses, zero-cost included |
| Average annual cybercrime cost, excluding phishing-only cases | ~£1,970 | Affected businesses, non-phishing-only |
Why the Breach Rate Stalled After Two Years of Decline
Context matters here. The 43% figure isn’t a spike, it’s a plateau after a real drop. Business breach rates fell from 50% in 2023/24 to 43% in 2024/25, and the 2025/26 survey shows that same 43% holding steady rather than continuing downward. That’s a meaningful shift in trajectory. Something that was improving has stopped improving, and the survey data doesn’t fully explain why on its own.
A few plausible drivers sit behind that stall. First, the easy wins are largely banked. Businesses that were going to adopt basic hygiene, multi-factor authentication on email, routine patching, staff awareness training, mostly did it during the earlier improvement period. What’s left is a harder core of organizations, often smaller ones with tighter budgets, that haven’t closed the gap and aren’t closing it quickly. Second, phishing techniques have kept pace with defenses. AI-assisted phishing content, more convincing impersonation, and better-targeted lures are raising the bar on what staff training alone can catch, even as awareness programs improve. Third, the survey methodology itself creates a ceiling effect: once you’ve filtered out businesses with genuinely no digital footprint to attack, the remaining population skews toward firms that are inherently more exposed simply by virtue of using email, cloud services, and remote access.
The upcoming Cyber Security Breaches Survey for 2026/27, already announced by DSIT as in progress, will be the number to watch. If the 43% figure holds a third year running, that’s a structural plateau, not a blip, and will justify a genuinely different policy response rather than an incremental one.
The Reuters Angle: A National Story, Not a Niche One
This isn’t a story confined to trade press. Reuters covered the government survey’s headline finding directly, reporting that over 40% of UK firms suffered a cyber attack in the past year, a framing that puts the story in front of a business and investor audience well beyond IT departments. That’s significant because cyber risk has increasingly become a board-level and insurance-underwriting concern in the UK, not just an IT budget line, yet GOV.UK’s own survey data, published in April 2025, found that only 27% of UK businesses had actually assigned board-level responsibility for cyber security, exposing a wide gap between rising attention and formal governance. When a wire service picks up a national breach statistic, it tends to accelerate two things: cyber insurance premium conversations and supply-chain due diligence questions from larger firms toward their smaller vendors.
That supply-chain angle is worth flagging on its own. Multiple analyses of the same 2025/26 dataset, including coverage from CACI, note that a meaningful share of UK businesses report a cyber incident that originated somewhere in their supply chain rather than directly against their own systems. A small supplier with weak security posture can become the entry point into a much larger client’s network, which is exactly why bigger firms are increasingly pushing security requirements, and sometimes Cyber Essentials certification, down onto smaller partners as a condition of doing business.
How UK Breach Rates Compare to Independent Industry Surveys
It’s worth being precise about why the 43% and 49% figures diverge, because conflating them risks overstating the picture in either direction. The DSIT survey is a large, government-run, weighted sample designed to represent the full UK business population across every size band, from sole traders to large enterprises. The ESET SMB Cyber Risk Report, released around September 17, 2026 according to Windows Forum’s coverage, surveyed 500 UK small and medium-sized businesses specifically, using a different methodology and a narrower size band.
Different sample, different result, and that’s expected. What’s notable is the direction: an SME-focused survey found a higher incident rate (49%) than the government’s all-business average (43%), which is consistent with the idea that smaller firms, once you actually get inside their systems with proper monitoring, show more incidents than a broad national average would suggest. It reinforces the underreporting theory rather than contradicting the official statistics.
What Experts and Named Authorities Recommend
The advice from DSIT and the NCSC hasn’t changed dramatically in substance, but the urgency behind it has grown given the plateaued breach rate. The core recommendations that recur across the government survey’s guidance and NCSC published material are straightforward and, notably, inexpensive relative to the potential breach costs outlined above:
- Enable multi-factor authentication on email accounts, remote access tools, and any administrator-level account, since credential theft via phishing remains the single most common entry point.
- Apply software and security updates promptly across operating systems, browsers, and business applications to close known vulnerabilities before attackers exploit them.
- Train staff regularly to recognize phishing attempts, covering suspicious links, unexpected attachments, urgent payment requests, and impersonation of colleagues or executives.
- Maintain offline or otherwise isolated backups, and actually test whether systems and data can be restored from them rather than assuming backups work.
- Restrict administrator privileges and enforce strong, unique passwords across business systems and cloud accounts.
- Build a written incident response plan covering detection, isolation, recovery, and internal and external communication before an incident happens, not during one.
- Consider certification through Cyber Essentials, the NCSC-backed scheme designed to help organizations address the most common technical weaknesses attackers exploit.
None of these measures require enterprise-scale budgets. That’s the point the government survey keeps implicitly making: the businesses getting breached most often at the smaller end of the size spectrum aren’t failing because good security is unaffordable, they’re failing because these baseline steps haven’t been implemented consistently. For teams that want a structured way to test their own staff’s phishing susceptibility rather than guessing, a controlled internal exercise using a tool like GoPhish can surface exactly where training gaps exist before a real attacker does.
The Detection Gap: Why Smaller Firms Underreport
One thread worth pulling on further is the detection gap between business sizes. A 42% breach rate for micro businesses sounds almost reassuring next to 69% for large firms, until you consider what’s actually being measured. Large organizations typically run endpoint detection and response tooling, security information and event management platforms, and dedicated staff whose job is to notice anomalies. A micro business running a handful of laptops and a shared email inbox has none of that instrumentation. It cannot report a breach it never detected.
This is precisely why entry-level tools matter disproportionately for smaller firms. A platform like Microsoft Defender for Endpoint gives smaller organizations a version of the visibility that larger firms already have, closing part of the detection gap without requiring a full security operations team. Similarly, ongoing exposure monitoring, the kind covered in guidance on setting up dark web monitoring, helps smaller businesses find out when their credentials or customer data have already leaked, often the first real evidence that a phishing-driven breach succeeded weeks or months earlier.
Ransomware’s Small Footprint Doesn’t Mean Small Risk
The 1% ransomware figure in the government survey, down from 3% in an earlier year, is genuinely good news on frequency. But frequency and severity are separate questions, and ransomware remains the category most likely to put a business out of operation entirely for days or weeks. Coverage of the ransomware-as-a-service ecosystem elsewhere on this site, including reporting on the Panzer ransomware group’s record-setting attack volume in August 2026, shows that while ransomware hits fewer UK businesses overall, the groups behind it are running at industrial scale globally, hitting dozens of organizations across sectors in a single month. A UK business that avoids becoming one of that 1% this year isn’t necessarily safe next year, it may simply not have been targeted yet.
Patch management ties directly into this. Unpatched software remains one of the most common ways ransomware operators gain initial access, and the scale of that problem became visible again in September 2026 when Microsoft shipped fixes for a record number of vulnerabilities in a single update cycle, detailed in coverage of that record Patch Tuesday release. Businesses that fall behind on applying updates like that one are, statistically, the ones most likely to appear in next year’s breach survey.
Competitive Landscape: How the UK Compares Internationally
The UK’s 43% business breach rate doesn’t exist in isolation. Cost-of-breach research cited by CACI, drawing on IBM’s global Cost of a Data Breach reporting, put the average UK breach cost at £3.4 million when measured using the broader enterprise-scale IBM methodology, one of the highest average figures among major economies in that dataset. That figure sits at a very different scale than the DSIT survey’s per-incident median costs, because IBM’s methodology captures large enterprise breaches specifically, including detection costs, lost business, regulatory fines, and remediation across the full incident lifecycle, while the DSIT survey spans the entire UK business population down to sole traders.
Read together, the two datasets tell a coherent story rather than a contradictory one: most UK businesses experience low-cost or no-cost incidents most of the time, but the minority of businesses, generally larger ones, that suffer a severe breach face costs that rank among the highest in the world. That combination, high frequency of low-severity incidents plus a long tail of very expensive ones, is what makes UK cyber risk difficult to communicate in a single statistic and why both the median and the tail figures need to be read side by side.
What Happens Next: Predictions for the Rest of 2026 and Into 2027
Based on the trajectory in this data, a few outcomes look likely over the coming months:
- The 2026/27 Cyber Security Breaches Survey, already announced by DSIT, will likely show the 43% figure holding roughly flat or ticking up slightly rather than resuming its earlier decline, given the plateau already visible across two consecutive editions.
- Phishing will remain the dominant attack category, and its share may grow further as AI-generated phishing content becomes harder for both staff and email filters to distinguish from legitimate correspondence.
- Cyber insurance underwriters will increasingly require proof of baseline controls, multi-factor authentication, patch cadence, and staff training in particular, as a condition of coverage, pushing smaller UK firms toward Cyber Essentials-style certification whether or not they see it as a security priority in its own right.
- Supply-chain security requirements will keep flowing downward from large enterprises to smaller vendors, meaning small UK businesses that want to keep larger contracts will face growing pressure to demonstrate basic cyber hygiene even if their own perceived risk feels low.
- The gap between large-business and small-business breach detection will narrow gradually as affordable endpoint monitoring and managed detection services become more accessible to smaller firms, likely producing an apparent rise in reported micro and small business breach rates in future surveys, not because attacks increased, but because detection finally caught up.
What This Means for Small Business Owners Right Now
Strip away the survey methodology debates and the headline number that matters is simple: a business with fewer than 50 employees today has roughly a two-in-five to nearly one-in-two chance of identifying a cyber incident this year, and the single most likely cause is a phishing email. The good news buried in this data is that the fixes are not expensive relative to the potential downside. Multi-factor authentication costs nothing beyond setup time in most modern business software. Staff phishing training can be run internally using free or low-cost tools. Patch management largely requires discipline rather than budget. Backup testing costs an afternoon.
The businesses most at risk aren’t necessarily the ones with the least money to spend on security, they’re the ones that haven’t yet treated these seven baseline steps as non-negotiable operating procedure rather than optional IT hygiene. Given that the median cost of a breach with an outcome sits at £560 but the 95th-percentile cost for medium and large firms reaches £10,000, the math on prevention versus remediation isn’t close.
Frequently Asked Questions
What percentage of UK businesses experienced a cyber breach in 2026?
According to the government’s Cyber Security Breaches Survey 2025/26, published by DSIT, 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. A separate ESET survey of 500 UK small and medium-sized businesses found a 49% incident rate using different methodology.
What is the most common type of cyber attack against UK businesses?
Phishing is by far the most common attack type, reported by 38% of all UK businesses in the latest DSIT survey. Among businesses that identified any breach, 69% said phishing was their most disruptive incident, and 51% experienced phishing exclusively with no other attack type.
How much does a cyber breach cost a UK business?
The median perceived cost across all businesses, including those with no financial loss, was £0. Among businesses reporting an actual financial outcome, the median cost was around £560, with a 95th-percentile figure of roughly £10,000 for medium and large businesses, according to DSIT’s technical report.
Are larger UK businesses more likely to be breached than small businesses?
Yes, reported breach rates rise with business size: 42% for micro businesses, 46% for small businesses, 65% for medium businesses, and 69% for large businesses. Analysts attribute part of this gap to larger firms having better detection tools, meaning smaller firms likely underreport rather than face genuinely lower risk.
How common is ransomware among UK businesses?
Ransomware affected approximately 1% of UK businesses in the latest survey, down from 3% in an earlier comparison year, making it far less frequent than phishing. It remains, however, one of the most financially and operationally destructive incident types when it does occur.
What is Cyber Essentials and does my business need it?
Cyber Essentials is a UK government-backed certification scheme run with NCSC support, designed to help organizations address the most common technical security weaknesses. It’s increasingly required by larger firms and public sector contracts as a condition of doing business with smaller suppliers.
What is the single most effective step a small business can take to reduce breach risk?
Enabling multi-factor authentication on email and remote access accounts is consistently cited by DSIT and NCSC guidance as the highest-impact, lowest-cost step, since credential theft via phishing is the leading cause of reported breaches.
Why did the UK business breach rate stop falling in 2025/26?
The 43% rate matches the prior year exactly, after falling from 50% in 2023/24. Analysts suggest the earlier decline reflected quick wins from basic hygiene adoption, while the businesses still getting breached now represent a harder core of under-resourced organizations facing increasingly sophisticated phishing techniques.
