What the 2026 UK Cyber Breaches survey means for your business

4 in 10 UK businesses were cyber attacked in the past year. Here's what actually changed, and what to do about it.

We've mentioned this before, but every year the government publishes a Cyber Security Breaches Survey. Every year it's tempting to skim past it. Big numbers, national picture, not exactly light reading. But this year's edition is worth five minutes, because the story it tells isn't "cybercrime is bad" (you knew that). It's that the attacks succeeding today look very different from the ones businesses were preparing for a few years ago.

• The Headline Numbers
• Why Phishing is Harder to Catch Now
• Why Small Businesses Specifically are Exposed
• Four Practical Steps to Take This Month
  
• What This Means For Your Business
• Next Steps..?

The Headline Numbers

If you own or run a business, there's a good chance cyber security has ended up on your to-do list more than once this year. According to the latest government figures, 43% of UK businesses experienced a cyber breach or attack in the last 12 months. On its own, that number isn't especially surprising. Cyber threats have been a fact of business life for years. The most interesting thing about this year's report isn't how many businesses were attacked; it is how many of those attacks looked ordinary at first glance.

Ransomware has also been rising sharply, with incidents reportedly doubling since 2025. What's important is that many of these attacks still being with just a phishing email, making human awareness one of the most important layers of defence.  City of London police figures put the average loss per ransomware attack at around £270,000 when you include downtime, recovery and lost business, not just any ransom paid. Phishing remains the way almost all of it starts and it is still the most common attack UK businesses report.

Why Phishing is Harder to Catch Now

The old advice to watch for spelling mistakes, odd phrasing, a sense something 'off' simply doesn't hold up the way it used to. Attackers can now use AI to write convincing emails in seconds. Messages that once contained obvious spelling mistakes or awkward wording can now look remarkably professional. 

This is where things get frustrating for smaller businesses. Big companies have security teams filtering this at the gate, while most small businesses are relying on one person noticing something feels wrong, which is a much thinner line of defence than it used to be. 

Why Small Businesses Specifically are Exposed

Attackers aren't necessarily targeting small businesses by name, but they know smaller businesses tend to have fewer resources dedicated to monitoring and detection and are statistically more likely to pay a ransom to get back up and running fast. That combination makes SMEs an attractive target rather than an accidental one. 

Add to that: over half of employees say they've had no cybersecurity training at all. Training is the cheapest defence available and it's the one most often skipped by businesses.

Four Practical Steps to Take This Month

You don't need a security overhaul to move the needle meaningfully.

• Try talking to your staff about modern phishing. Even 20 minutes makes a measurable difference especially now that 'spot the typo' no longer works as advice.

• Check your backup and recovery plan actually works, not just that the backups exist but that you've tested restoring from one recently. 

• Write down what happens in the first hour of an incident. So, who gets called, who can make the call to isolate a system, who tells clients if required. Imagine someone clicks a malicious link at 09.05am on Monday morning. Who do they tell? Who speaks to the customers if there is a disruption? Having those answers written down removes a huge amount of stress when every minute counts.

• Turn on Multi-Factor Authentication wherever possible. It's one of the simplest and most effective ways to reduce the impact of stolen passwords.

What This Means For Your Business

Cybersecurity isn't about trying to eliminate every risk. No organisation can do that, The goal is to make sure a single click, compromised account or suspicious email doesn't turn into a major business disruption. The businesses that recover fastest aren't always the ones with the biggest security budgets. More often, they're the ones that have spent some time thinking through what happens when something goes wrong.

Next Steps..?

The government figures show that cyber incidents are no longer something that happens to other businesses. They're affecting organisations of every size, every day.

A simple question to ask yourself is this: if someone in your business clicked a convincing phishing email tomorrow morning, would everyone know what happens next?

If you're not completely sure, that's a good place to start.

And if you'd like an independent view of your current cyber security, backup, or recovery plans, we'd be happy to help you identify any gaps before they become problems.