43% of UK businesses were breached last year, and the basics still are not in place

The Government's Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses hit by a breach or attack in the previous year, roughly 612,000 businesses. The uncomfortable part is how few have the fundamentals.

The headline

Published on 30 April 2026 by the Department for Science, Innovation and Technology and the Home Office, the survey is the most reliable annual benchmark of UK cyber resilience. Its headline finding is that 43% of businesses experienced a breach or attack in the last twelve months, which works out at around 612,000 organisations.

Phishing does most of the damage

Phishing remains the dominant way in, and the large majority of businesses that were hit describe it as their most disruptive type of incident. Ransomware has become less common but more damaging when it lands. In other words, the attacks that hurt are mostly the ordinary, high-volume ones, not exotic threats.

The basics are still missing

The same survey shows how thin the defences are: only around 5% of UK businesses hold Cyber Essentials, fewer than half use two-factor authentication, and only about a third put cyber security responsibility at board level. Most breaches do not happen because a business lacked some clever tool; they happen because the basics were not in place.

It is hitting the bottom line

The business impact has grown. More breached firms are reporting lost revenue and reputational damage than in previous years. A breach is no longer just an IT inconvenience; it increasingly shows up in the profit and loss account and in customer due diligence.

What to do first

The report points straight at the fundamentals attackers exploit: multi-factor authentication everywhere, prompt patching, controlled access, and a recognised baseline such as Cyber Essentials. Independent testing then shows whether those controls actually hold up in practice, rather than just on paper.

How we help

We help businesses put the baseline in place with Cyber Essentials, prove it works with penetration testing, and get an honest view of where the real gaps are. No jargon, no upselling, just the things that genuinely reduce your risk.

Common questions