Statistics used in the charts
United Kingdom Cyber Security Breaches Survey 2025/2026
Published by the Department for Science, Innovation and Technology and the Home Office on 30 April 2026. The business survey included 2,112 United Kingdom businesses and fieldwork took place from August to December 2025.
The charts use figures for identified breaches or attacks, business size, phishing, incident frequency, two-factor authentication, software-update policies, incident-response planning and security considerations when buying software.
Open the official government survey
National Cyber Security Centre Annual Review 2025
The incident-management section reports 204 nationally significant incidents during 2024–2025, compared with 89 during 2023–2024. It also explains that these records are not a complete count of all United Kingdom cyber incidents because reporting is not always mandatory.
Open the official incident-management figures
Helpful official guidance
Small organisations guide to cyber security
Practical guidance covering backups, devices, email, important accounts and spotting scams.
Open the small organisations guide
Actions when the cyber threat is heightened
The guidance explains that risk can rise because of factors such as newly exploited weaknesses, hacktivism or geopolitical tension. It recommends that organisations of all sizes keep the fundamentals working properly.
Open the heightened-threat guidance
Secure design principles
Guidance for planning systems so compromise and disruption are harder, detection is easier and the impact of an incident is reduced.
Open the secure design principles
How to read the statistics
- The survey reports incidents organisations identified and were willing to disclose.
- Sole traders, most public-sector organisations and businesses with no online or information-technology capacity were outside the survey scope.
- Percentages from different questions should not be added together.
- The National Cyber Security Centre incident figures cover cases reported to and supported by its incident-management team, not every incident in the country.
- Figures should be reviewed when new official editions are published.
Website data last reviewed: 16 July 2026.