Cybersecurity statistics combine UK organization surveys, reported complaints, a contributed breach dataset, and consumer reports. Their definitions and populations differ, so each figure retains its period, geography, and measurement limitation.
Key Cybersecurity Statistics
These highlights span prevalence, attack patterns, complaints, preparedness, costs, and critical infrastructure:
- In 2025/2026, 43% of UK businesses, about 612,000 businesses, reported a breach or attack.
- In 2025/2026, 28% of UK charities, about 57,000 charities, reported a breach or attack.
- In 2025/2026, 63% of UK information and communication businesses reported a breach or attack, versus 43% overall.
- In 2025/2026, 19% of UK businesses and 14% of charities experienced cybercrime, about 267,000 and 28,000 organizations.
- In 2025/2026, 93% of cybercrime among affected UK businesses and charities was phishing, equal to 18% of all businesses and 13% of all charities.
- In 2025/2026, UK businesses experienced about 5.19 million cybercrimes and charities about 525,000.
- In the 2023–2024 Verizon DBIR cycle, the human element was involved in 68% of breaches in its contributed global dataset.
- In that cycle, ransomware appeared in 23% of breaches and pure extortion in 9%, together 32%.
- During 2020–2024, FBI IC3 received 4.2 million complaints tied to $50.5 billion in reported losses worldwide.
- In 2024, IC3 recorded 193,407 phishing or spoofing complaints.
- In 2024, IC3 reporters aged 60+ filed 147,127 complaints tied to $4.8 billion.
- In the 2025 UK survey, cybersecurity was a high priority for 72% of businesses and 68% of charities.
- From 2021 to 2025, board-level cybersecurity responsibility among UK businesses fell from 38% to 27%.
- In 2025, 42% of UK businesses and 37% of charities sought external cybersecurity guidance.
- In 2025/2026, the mean number of cybercrimes among affected UK businesses and charities was 19 for each group.
- In 2025/2026, the median UK business cybercrime cost other than phishing was £250 including zero-cost cases and £750 excluding them.
- In the 2023–2024 Verizon cycle, the median loss for ransomware or extortion breaches was $46,000.
- In 2024, IC3 recorded 263,455 cyber-threat complaints and $1.571 billion in reported losses.
- In Verizon’s 2024 analysis, median time to first internet scan was five days for CISA KEV vulnerabilities and 68 days for other CVEs.
Contents
- Key Cybersecurity Statistics
- Cybersecurity Scale and Prevalence Data
- Cybersecurity Threat Types and Attack Patterns
- Cybercrime Complaints, Losses, and Consumer Harm
- Cybersecurity Adoption, Governance, and Preparedness
- Cybersecurity Business Impact, Cost, and Repeat Victimization
- Critical Infrastructure and Global Cybersecurity Context
Cybersecurity Scale and Prevalence Data
The UK Cyber Security Breaches Survey 2025/2026 distinguishes any breach or attack from the narrower statistical category of cybercrime. Percentages are self-reported, and organization totals are survey extrapolations.
| UK organization measure | Result | Period |
|---|---|---|
| Businesses reporting any breach or attack | 43%, about 612,000 | 2025/2026 |
| Charities reporting any breach or attack | 28%, about 57,000 | 2025/2026 |
| Businesses experiencing cybercrime | 19%, about 267,000 | 2025/2026 |
| Charities experiencing cybercrime | 14%, about 28,000 | 2025/2026 |
Information and communication businesses had 63% prevalence, while professional, scientific, and technical businesses had 54% and retail and wholesale businesses had 31%. Among charities, prevalence was 22% for low-income organizations, 39% for medium-income organizations, and 57% for high-income organizations.
UK business prevalence was 50% in 2023/2024, then 43% in both 2024/2025 and 2025/2026. Among organizations reporting any breach, 44% of businesses and 49% of charities also reported cybercrime; the survey estimated about 5.19 million business cybercrimes and 525,000 charity cybercrimes.
Cyber security breaches survey 2025/2026
Cybersecurity Threat Types and Attack Patterns
Phishing accounted for 93% of cybercrime among affected UK businesses and charities in 2025/2026. It affected 18% of all businesses and 13% of all charities, while non-phishing cybercrime affected 3% and 2%.
| Threat measure | UK businesses | UK charities | Population basis |
|---|---|---|---|
| Hacking | 8% | 4% | Organizations experiencing cybercrime |
| Ransomware | 3% | 5% | Organizations experiencing cybercrime |
| Denial of service | 3% | 2% | Organizations experiencing cybercrime |
| Viruses, spyware, or malware | 2% | 2% | Organizations experiencing cybercrime |
The survey estimated 5.13 million phishing cybercrimes against businesses, 523,000 against charities, and 70,000 non-phishing cybercrimes against businesses. Phishing was the most disruptive attack for 69% of both businesses and charities reporting an incident.
Cyber security breaches survey 2025/2026
The Verizon 2024 Data Breach Investigations Report uses a contributed global post-incident dataset rather than a complete population. Ransomware appeared in 23% of breaches and pure extortion in 9%, ransomware or extortion ranked among the top threats in 92% of industries, the human element appeared in 68% of breaches, and vulnerability exploitation as an entry path increased 180% year over year.
2024 Data Breach Investigations Report
Cybercrime Complaints, Losses, and Consumer Harm
FBI IC3 received 4.2 million complaints and $50.5 billion in reported losses during 2020–2024, plus more than 9 million complaints cumulatively from 2000 through 2024. These are reported complaints and losses, not a census of all cybercrime.
| IC3 2024 measure | Reported result |
|---|---|
| Phishing or spoofing complaints | 193,407 |
| Personal-data-breach complaints | 64,882 |
| Data-breach complaints | 3,204 |
| Ransomware complaints | 3,156 |
| Business-email-compromise losses | $2.770 billion |
| Personal-data-breach losses | $1.453 billion |
| Phishing losses | $70.0 million |
Reporters aged 60+ filed 147,127 complaints tied to $4.8 billion, while reporters aged 50–59 filed 84,540 complaints tied to $2.5 billion. IC3’s Recovery Asset Team handled 3,020 complaints involving $848.4 million in attempted theft and reported a 66% success rate; that result applies to the team’s handled complaints.
The FTC Consumer Sentinel Network Data Book recorded 6.5 million reports across 29 top categories in 2024. Its dollar-loss calculations used reports indicating losses from $1 through $999,999; the reports are unverified and are not a survey.
Consumer Sentinel Network Data Book 2024
Cybersecurity Adoption, Governance, and Preparedness
In the 2025 UK survey, cybersecurity was a high priority for 72% of businesses and 68% of charities, rising to 92% of medium businesses and 96% of large businesses. Board-level responsibility among UK businesses declined from 38% in 2021 to 27% in 2025.
| Preparedness or awareness measure | Businesses | Charities | Period |
|---|---|---|---|
| Sought external cybersecurity guidance | 42% | 37% | 2025 |
| Consultants or IT providers as an information source | 25% | 17% | 2025 |
| Cyber Aware awareness | 24% | 26% | 2025 |
| 10 Steps guidance awareness | 12% | 15% | 2025 |
| Cyber Essentials awareness | 12% | 15% | 2025 |
| Guidance on external incident reporting | 32% | 30% | 2025 |
Cyber Aware awareness had been 34% among businesses and 38% among charities in 2021. Incident-response plans were reported by 53% of medium businesses and 75% of large businesses.
Cyber security breaches survey 2025
Cybersecurity Business Impact, Cost, and Repeat Victimization
Among affected UK businesses and charities, the mean number of cybercrimes was 19 for each group. Among affected businesses, 20% reported 11–99 cybercrimes and 5% reported 100+; among affected charities, the corresponding figures were 23% and 4%.
For UK business cybercrime other than phishing, the median cost was £250 including zero-cost cases and £750 excluding them. The interquartile range was £0–£3,000 including zero-cost cases and £250–£5,000 excluding them, while the top-10% cost threshold was £5,000 including zero-cost cases and £7,500 excluding them.
Cyber security breaches survey 2025/2026
In the Verizon dataset, the median loss for ransomware or extortion breaches was $46,000, with 95% of losses between $3 and $1,141,467. In negotiation data covering the 2022–2024 cycle, the median initially requested ransom was 1.34% of victim revenue; these are selected post-incident observations, not universal averages.
2024 Data Breach Investigations Report
Critical Infrastructure and Global Cybersecurity Context
IC3 recorded 263,455 cyber-threat complaints and $1.571 billion in reported losses in 2024, including 4,878 complaints from critical-infrastructure organizations. The figures represent worldwide IC3 reporters and reported losses rather than a complete inventory of attacks.
Verizon’s 2024 analysis found a median time to first internet scan of five days for vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog, compared with 68 days for other CVEs. This describes the analyzed global DBIR dataset and does not mean every vulnerability is scanned on those exact timelines.
2024 Data Breach Investigations Report
The UK survey estimated 5.13 million phishing cybercrimes against businesses and 523,000 against charities, plus 70,000 non-phishing cybercrimes against businesses. The FTC recorded 6.5 million reports across 29 top categories in 2024, using dollar-loss reports indicating losses from $1 through $999,999; FTC reports are unverified.
Cyber security breaches survey 2025/2026 and Consumer Sentinel Network Data Book 2024