Cyber attacks on small businesses: what the numbers really say

The survey

Every year the UK government publishes the Cyber Security Breaches Survey, one of the largest regular studies of how businesses and charities experience cyber attacks. The 2025/26 edition was published on 30 April 2026. Although it is a UK survey, the patterns are similar to what security teams see in many countries.

The headline numbers

• 43 percent of businesses and 28 percent of charities reported a breach or attack in the previous 12 months, similar to the year before.
• Phishing was the most common type, experienced by 38 percent of businesses. For 69 percent of those affected, it was also the most disruptive.
• Ransomware affected about 1 percent of businesses, down from 3 percent in each of the two previous years.
• For most organisations the cost of the worst incident was low, but the most serious cases cost thousands of pounds, and larger organisations reported higher costs.

What this tells us

The everyday threat is phishing, not Hollywood hacking. Most attacks start with a convincing email, text or call that tricks someone into clicking, paying or sharing a password. Ransomware gets the headlines because each case can be devastating, but it is far less common for small organisations than a steady stream of phishing.

Low average costs can hide big risks. Many incidents are caught early and cost little. But a single successful invoice fraud or ransomware attack can threaten a small company's survival. Our analysis Why big breaches keep happening looks at the larger cases.

Surveys only count what people notice. Smaller organisations with fewer checks may simply not detect some attacks, so the real figures may be higher.

Where to spend limited time and money

1. Train staff to spot phishing and make it easy and blame-free to report it. See Spotting scam messages.
2. Turn on 2-step verification for email, banking and cloud accounts. See 2-step verification.
3. Agree a rule for payments: any change of bank details must be confirmed by phone using a known number.
4. Keep devices and software updated, including firewalls and routers.
5. Keep offline or separate backups and test restoring them. See How to back up your files.
6. Use a simple framework such as the UK's Cyber Essentials scheme to check the basics are covered.

Tip: Write a one-page plan: who to call, how to reach your bank and IT support, where backups are kept. In an incident, people panic; a short plan helps.

The bottom line

For most small businesses, cyber security is less about buying advanced products and more about doing a few basic things consistently. Our technical notes on phishing response and incident response planning can help IT staff take the next step.

Charities are targets too

The survey found that 28 percent of charities reported a breach or attack. Charities often rely on volunteers, shared accounts and donated equipment, which can make basic security harder. The same low-cost steps apply, and free guidance for small charities is available from national cyber security agencies.