UK cyber attack statistics
43% of UK businesses and 28% of charities identified a cyber breach or attack in the past year, according to the Cyber Security Breaches Survey 2025/2026. The NCSC handled 204 nationally significant incidents in the year to August 2025, up from 89 the year before.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The headline figures
This page collects official UK figures from two sources: the government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, and the NCSC Annual Review 2025. We'll update it when new editions are published. They measure different things, so don't add them together.
How many organisations are affected?
The survey covers breaches or attacks organisations identified in the previous 12 months.
| Group | Identified a breach or attack |
|---|---|
| All businesses | 43% (about 612,000) |
| Medium businesses | 65% |
| Large businesses | 69% |
| All charities | 28% (about 57,000) |
What kinds of attack?
Phishing is by far the most common, affecting 38% of businesses and 25% of charities. Ransomware affected 1% of businesses, down from 3% in each of the two previous surveys.
Ransomware is rare in this survey because it's measured across all businesses, most of which are small. A low share can still mean many serious incidents, and the survey doesn't measure how severe each one was at national level.
How much do attacks cost?
These are the costs of the most disruptive breach or attack. The survey reports medians rather than a headline average, because a small number of very expensive incidents would distort an average.
| Measure | Businesses | Charities |
|---|---|---|
| Median | £0 (£30 for medium and large businesses) | £0 |
| Middle 50% | £0 to £200 | £0 to £80 |
| 95th percentile | £4,000 (£10,000 for medium and large businesses) | £1,000 |
Treat these as self-reported figures. Respondents may not capture wider costs such as lost customers, and they don't represent the largest attacks on major companies.
How prepared are organisations?
| Measure | Businesses | Charities |
|---|---|---|
| Board member responsible for cyber security | 31% (68% of large businesses) | 30% |
| Reviewed risks from immediate suppliers | 15% | 9% |
| Reviewed risks from the wider supply chain | 6% | 4% |
| Reported their most disruptive breach outside the organisation | 40% | 36% |
What does the NCSC see?
The NCSC's figures cover incidents it handled, in years running from September to August.
| Year | Tips received | Incidents handled | Nationally significant | Of which highly significant |
|---|---|---|---|---|
| 2024–25 | 1,727 | 429 | 204 | 18 |
| 2023–24 | 1,957 | 430 | 89 | 12 |
| 2022–23 | 2,005 | 371 | 62 | 4 |
| 2021–22 | 1,226 | 355 | 63 | 1 |
The NCSC notes that the rise in tips in 2022–23 reflects a change in data collection, so don't compare that figure directly with other years. It described 204 nationally significant incidents as about four a week.
How to use these figures
Three cautions if you quote them:
- Identified isn't the same as attempted. Organisations can only report what they notice, and better detection can raise the figure.
- "Cyber attacks per day" isn't an official measure. We haven't found a reliable official daily count for all attacks in the UK, so be wary of any that doesn't explain its source.
- Check the year and group. The figures vary a lot between small and large organisations, so quote the group you mean.
What it means for the Bill
The Cyber Security and Resilience Bill (CSRB) focuses on essential services and key suppliers. Two figures here matter most for that:
- Supply chains: only 15% of businesses review immediate suppliers, yet the Bill introduces critical supplier designation and duties on managed service providers.
- Reporting: 40% of businesses reported their most disruptive breach externally. The Bill would require regulated organisations to report significant incidents within 24 and 72 hours.
These figures don't show how many organisations the Bill would regulate, as the survey covers all businesses and charities. For more on what the survey means for preparation, read our analysis of the survey.
Sources
Frequently asked questions
The Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses identified a breach or attack in the previous 12 months. That rises to 65% of medium businesses and 69% of large businesses.
The NCSC handled 204 nationally significant incidents in the year to August 2025, up from 89 the year before. The NCSC described that as about four a week.
There is no reliable official daily figure for all attacks. Published figures count identified breaches, or incidents reported to the NCSC, so they do not measure every attempted attack.
Phishing. The survey found it affected 38% of businesses and 25% of charities.