By Aijaz Alam
What percentage of UK businesses had a cyber attack?
43% of UK businesses, about 612,000 firms, identified a cyber security breach or attack in the last 12 months, according to the government's Cyber Security Breaches Survey 2025/2026 (DSIT, fieldwork August to December 2025). That is unchanged from 2024/2025 and down from 50% in 2023/2024. Large firms report far more: 69%, against 42% of micro businesses.
- 43%UK businesses that identified a cyber breach or attack in the last 12 months, about 612,000 firmsDSIT Cyber Security Breaches Survey, fieldwork Aug-Dec 2025
- 69%Large UK businesses (250+ staff) that identified a breach or attackDSIT, Aug-Dec 2025
- 42%UK micro businesses (1 to 9 staff) that identified a breach or attackDSIT, Aug-Dec 2025
- 28%UK registered charities that identified a breach or attackDSIT, Aug-Dec 2025
- 38%UK businesses hit by phishing, by far the most common typeDSIT, Aug-Dec 2025
- 19%UK businesses that were victims of at least one cyber crimeDSIT, Aug-Dec 2025
The numbers
The full breakdown
UK businesses that identified a breach or attack in the last 12 months, by size
| Business size | 2025/2026 | 2024/2025 |
|---|---|---|
| Micro (1 to 9 staff) | 42% | 41% |
| Small (10 to 49 staff) | 46% | 50% |
| Medium (50 to 249 staff) | 65% | 67% |
| Large (250+ staff) | 69% | 74% |
| All businesses | 43% | 43% |
Bases 2025/2026: 1,154 micro, 507 small, 296 medium and 155 large businesses; 2,112 overall. In 2023/2024, 70% of medium and 74% of large businesses identified a breach or attack (50% overall); that release does not give micro and small in its text.
Types of breach or attack in the last 12 months, share of all UK businesses and charities (2025/2026)
| Type | Businesses | Charities |
|---|---|---|
| Phishing attacks | 38% | 25% |
| People impersonating the organisation or staff in emails or online | 12% | 7% |
| Devices targeted with malware (viruses or spyware) | 7% | 3% |
| Hacking or attempted hacking of online bank accounts | 3% | 1% |
| Denial of service attacks | 3% | 1% |
| Takeovers or attempts to take over website, social media or email accounts | 2% | 1% |
| Devices targeted with ransomware | 1% | 1% |
| Unauthorised access to files or networks by staff, even if accidental | 1% | 1% |
Among businesses that identified any breach or attack, 88% had phishing. Ransomware fell from 3% of businesses in 2023/2024 and 2024/2025 to 1%. Bases: 2,112 businesses, 1,085 charities.
UK businesses that identified a breach or attack in the last 12 months, by sector (2025/2026)
| Sector | Identified a breach or attack |
|---|---|
| Information and communication | 63% |
| Professional, scientific or technical | 54% |
| Utilities or production | 49% |
| Administration or real estate | 48% |
| Construction | 45% |
| Transport or storage | 45% |
| Finance or insurance | 44% |
| Entertainment or service | 42% |
| Agriculture, forestry or fishing | 36% |
| Health or social care | 33% |
| Food or hospitality | 33% |
| Retail or wholesale | 31% |
| Businesses overall | 43% |
Some sector samples are small (69 agriculture and 81 information and communication businesses). Only information and communication and professional, scientific or technical were significantly above the overall figure.
UK charities that identified a breach or attack in the last 12 months, by annual income
| Charity income | 2025/2026 | 2024/2025 |
|---|---|---|
| Low (under £100,000) | 22% | 24% |
| Medium (£100,000 to £499,999) | 39% | 42% |
| High (£500,000 or more) | 57% | 64% |
| All charities | 28% | 30% |
In 2023/2024, 66% of high-income charities and 32% of all charities identified a breach or attack.
Over time
UK organisations that identified a breach or attack, every comparable survey
| Survey (fieldwork) | Businesses | Estimated businesses | Charities | Businesses that were victims of cyber crime |
|---|---|---|---|---|
| 2023/2024 (Sep 2023 to Jan 2024) | 50% | About 718,000 | 32% | 22% |
| 2024/2025 (Aug to Dec 2024) | 43% | About 612,000 | 30% | 20% |
| 2025/2026 (Aug to Dec 2025) | 43% | About 612,000 | 28% | 19% |
The question on breaches and attacks was reworded in 2023/2024, so DSIT says results can only be compared with 2023/2024 onwards. Each survey is named for the year it is published; fieldwork runs at the end of the year before.
Why sources differ
Same question, different answers
| Number | When | Who measured | Why it differs |
|---|---|---|---|
| 43% | Aug-Dec 2025 | DSIT Cyber Security Breaches Survey | UK businesses that identified any breach or attack in the last 12 months, including attempts that did not get through |
| 19% | Aug-Dec 2025 | DSIT Cyber Security Breaches Survey | Businesses that were victims of a cyber crime, a narrower legal definition (Computer Misuse Act and Home Office counting rules) |
| 38% | Aug-Dec 2025 | DSIT Cyber Security Breaches Survey | Businesses that had a phishing attack, the most common single type |
| 3% | Aug-Dec 2025 | DSIT Cyber Security Breaches Survey | Businesses that were victims of fraud that resulted from a breach or attack |
| 5.19 million | Aug-Dec 2025 | DSIT Cyber Security Breaches Survey | Estimated number of cyber crimes against UK businesses, a count of incidents, not of firms |
UK cyber attack figures come mostly from one official survey, but it publishes several different measures, and they are easy to mix up.
The headline 43% counts any breach or attack a business identified in the last 12 months. That includes phishing emails that staff received and attempts that never got past the firm's defences. The narrower cyber crime measure, 19%, counts only incidents that are crimes under the Computer Misuse Act and Home Office rules. Fraud that followed an attack was 3%.
Some figures count incidents, not businesses. The survey estimates 5.19 million cyber crimes against UK businesses in a year; the median business that had a cyber crime had three.
Size changes the answer a lot: 69% of large firms against 42% of micro firms. DSIT notes that smaller firms may simply be less able to spot attacks, so the gap partly reflects detection.
Older releases used a different question, so figures from before 2023/2024 are not comparable with these.
What it means
How to use these numbers
Close to half of UK businesses deal with some kind of cyber breach or attack each year, but for most of them it is a phishing email rather than a damaging incident. The median cost of the most disruptive breach was £0 for businesses, and 19% of businesses that identified a breach or attack had any negative outcome from it.
Reported attacks rise with size: 69% of large firms identified one, against 42% of micro firms. DSIT says part of the gap may come from smaller firms having less sophisticated monitoring, so they identify and report fewer attacks.
The trend is flat. After a fall from 50% to 43% between 2023/2024 and 2024/2025, the share held at 43% in 2025/2026. Ransomware against businesses fell to 1%.
For a small business the practical lesson is phishing: it reached 38% of all businesses and 88% of those that had any breach or attack. Staff training, two-factor login and checks on unexpected payment requests are the basic defences against it.
Method and sources
How it was measured
Method
- Publisher
- Department for Science, Innovation and Technology (DSIT) with the Home Office; official statistics
- Sample
- 2,112 UK businesses and 1,085 registered charities, random-probability telephone and online survey, weighted to the UK population
- Fieldwork
- August to December 2025; published as the Cyber Security Breaches Survey 2025/2026
- Definition
- Any cyber security breach or attack the organisation identified in the last 12 months, including attempts; cyber crime is a narrower subset
- Out of scope
- Sole traders, public sector bodies (other than education, reported separately) and businesses with no IT or online presence
- Comparability
- The breach question was reworded in 2023/2024; compare only with 2023/2024 onwards
- Last changed
- 31 Oct 2026
- Data files
- CSV · JSON (stable links)
Sources
- Cyber Security Breaches Survey, UK Department for Science, Innovation and Technology (DSIT) Official data
Cite this page
APA
MLA
HTML link
FAQ
More questions people ask
Are small businesses attacked less than large ones?
They report fewer attacks: 42% of micro and 46% of small businesses identified one, against 65% of medium and 69% of large firms. DSIT says smaller firms may detect fewer attacks, so part of the gap is detection.
What is the most common cyber attack on UK businesses?
Phishing. It reached 38% of all UK businesses in 2025/2026, followed by impersonation in emails or online (12%) and malware (7%).
How much does a cyber attack cost a UK business?
Usually little. The median perceived cost of the most disruptive breach was £0, and the middle half of cases fell between £0 and £200. The top 5% of cases cost £4,000 or more.
Are cyber attacks on UK businesses rising?
Not in this survey. The share was 50% in 2023/2024 and 43% in both 2024/2025 and 2025/2026.
Every number on this page was checked at its original source (UK Department for Science, Innovation and Technology (DSIT)). Free to cite with a link to this page.