Every year the UK government surveys hundreds of businesses and charities about cyber security, and the results are one of the few reliable pictures of what is really happening, as opposed to what vendors say is happening. The latest edition, the Cyber Security Breaches Survey 2025/26, was published on GOV.UK on 30 April 2026. It is based on interviews with 2,112 businesses carried out between August and December 2025.

This article pulls out the figures that matter to a small or medium business, explains what they do and don’t tell you, and ends with five practical things you can do this month. Every number below comes from the official report.

43%
Of UK businesses identified a breach or attack in the last 12 months
38%
Were targeted by phishing, the most common type of attack
5%
Hold the Cyber Essentials certification

The headline: 43% of businesses were affected

The survey found that 43% of UK businesses, about 612,000 in total, identified a cyber breach or attack in the 12 months before they were interviewed. That is more than four in ten. For businesses that think “we’re too small to be a target”, the data says otherwise.

Bigger firms report more, but small ones are not safe

The share of businesses that identified a breach or attack rises with size:

Micro businesses
42% affected
The smallest firms are very far from immune.
Under 10 staff
Small businesses
46% affected
Nearly half identified an incident in the year.
10 to 49 staff
Medium businesses
65% affected
More staff, devices and suppliers means more ways in.
50 to 249 staff
Large businesses
69% affected
The highest rate, likely partly because larger firms have better monitoring to notice incidents.
250+ staff

It’s worth remembering that the survey records what businesses identified. Larger firms are more likely to have the monitoring to spot an incident, and smaller firms may miss some.

“Even among the smallest businesses, more than four in ten identified a breach or attack in a single year.”

Phishing is still the way in

38% of businesses were targeted by phishing, the fake emails and messages designed to steal logins or trick staff into paying or sharing data. A further 12% experienced impersonation, where someone pretends to be the business or one of its people. Ransomware was reported by 1% of businesses: much rarer, but the most disruptive when it happens.

The practical lesson is that most attacks aren’t sophisticated hacking. They rely on a person clicking, which is why accounts protected by multi-factor authentication and staff who know what a suspicious message looks like are your best early defence.

What the cost figures really say

The survey asked about the cost of each business’s most disruptive breach or attack, and the answer is more nuanced than headline numbers suggest:

  • Typical cost: £0The median perceived cost for businesses was £0. Most incidents are caught early or do little direct damage.
  • The bad ones are expensiveAt the 95th percentile, meaning the worst 1 in 20, the cost was £4,000 for businesses overall and £10,000 for medium and large businesses.

You can’t know in advance which kind of incident you’ll get. A cheap day is luck; being ready for the expensive one is preparation.

Where businesses are falling short

The most useful part of the survey is what businesses haven’t done:

Two-factor authentication
47% of businesses
Fewer than half had it in place, even though it makes stolen passwords far harder to use.
Switch it on everywhere
Incident response plan
25% of businesses
Only one in four had a formal plan for what to do when something goes wrong.
Write one page
Supplier checks
15% / 6%
15% reviewed the risks from immediate suppliers; 6% looked at their wider supply chain.
Ask your key suppliers
Cyber Essentials
5% certified
Separately, 24% had the technical controls Cyber Essentials covers in all five areas.
Controls first, certificate second
AI use
31% using or considering
Of those, only 24% had cyber security practices to manage the risks of AI.
Set a simple AI rule
Cyber Security

Want an honest view of where your business stands?

Talk to us about the basics: multi-factor authentication, patching, backups and a simple response plan. Techfident manages your relationship and writes the initial project brief, and our specialist partner delivers penetration testing, vulnerability scanning and Cyber Essentials work through our cyber security service.

Five things to do this month

  • 1. Turn on multi-factor authentication everywhereStart with email, Microsoft 365, remote access and every admin account. It is one of the most effective steps on the list.
  • 2. Write a one-page incident planWho to call, who decides, how to disconnect an affected device, and where your backups are. Print it, because you won’t be able to open it on a locked-up network.
  • 3. Ask your key suppliers how they protect your dataInclude your IT provider, your accountant and any software that holds customer information. Only 15% of businesses do.
  • 4. Set a simple rule for AI toolsWhich tools staff may use, and what data must never be pasted into them, such as customer records or contracts.
  • 5. Work towards Cyber EssentialsThe five controls are good practice whether or not you certify. Our guide to what Cyber Essentials is and whether you need it is a good starting point.
 The bottom line

Cyber incidents are common, and small businesses are firmly in the picture. Most are phishing-led, many are cheap and a few are expensive. The businesses that come out best have the basics in place before something happens: multi-factor authentication, a plan, a view of their suppliers and a clear rule for new tools like AI.

Source: UK Government, Cyber security breaches survey 2025/2026, published 30 April 2026. Figures are for UK businesses; fieldwork ran from August to December 2025 with 2,112 businesses. Cost figures are medians and percentiles of perceived cost for each business’s most disruptive breach or attack, not averages. Size bands (micro, small, medium, large) follow the standard definitions used in the survey.

Common questions about the survey

It is an annual UK government survey of businesses and charities about their cyber security, including how many were attacked, what the attacks cost and what protections they have in place. The 2025/26 edition was published on GOV.UK on 30 April 2026 and covers 2,112 businesses interviewed between August and December 2025.

43% of UK businesses, about 612,000, identified a cyber breach or attack in the 12 months before they were interviewed. For micro businesses the figure was 42%, small 46%, medium 65% and large 69%.

Phishing. 38% of businesses were targeted by phishing, 12% experienced impersonation and 1% reported ransomware.

Yes. 42% of micro businesses and 46% of small businesses identified a breach or attack. Attackers often target businesses of all sizes with automated, opportunistic methods such as phishing emails.

Turn on multi-factor authentication for email, Microsoft 365, remote access and admin accounts. The survey found only 47% of businesses had two-factor authentication in place. After that, write a simple incident response plan and review your suppliers.