Cyber crime is no longer exceptional - it's an everyday challenge for UK businesses and charities.
Here's what this year's data reveals, and what you can do to stay ahead.
Contents
What Is Cyber Crime?
Cyber crime is any illegal activity involving computers, networks, or digital information.
According to the UK's Computer Misuse Act 1990, cyber crime includes hacking, unauthorised access to systems, data theft, ransomware, and attacks that damage digital infrastructure.
The 2024 UK Cyber Security Breaches Survey measured crimes where an organisation's defences were breached with intent or harm occurred - not only attempted attacks.
Phishing, hacking, and ransomware top the charts.
What The UK Cyber Breaches Survey Found
One in five UK businesses recorded a cyber crime in the past year.
That scale is why firms of every size need a clear view of how attacks show up in practice.
Why Is Understanding Cyber Crime Important?
Today, even small businesses aren't immune to cyber threats.
Attackers increasingly target organisations of every size - and the impact can go far beyond IT.
Financial losses, fraud, data breaches, and business disruption are all very real risks.
Understanding the scope and nature of cyber crime helps you make informed choices about how to protect your business, customers, and reputation.
"National survey data is a useful wake-up call, but the operational question is whether your team can spot phishing in real inboxes and respond when something gets through."
Paul Holland, Founder and CEO, Beyond Encryption (Mailock)
How Do Cyber Criminals Target Organisations?
Common attack routes include:
- Phishing: Deceptive emails or websites lure staff into disclosing sensitive information or downloading malware. This is the UK's number one cyber crime vector.
- Ransomware: Malicious software encrypts files or locks systems. Attackers demand a ransom to restore access.
- Hacking & Unauthorised Access: Criminals gain entry to email, bank, or business accounts - sometimes to steal information, sometimes simply to cause harm.
- Denial of Service (DoS): Attackers try to flood your network or website, disrupting operations.
- Viruses, Malware, & Account Takeovers: These methods can either be ends in themselves or stepping stones to larger frauds.
Recent survey data shows that while phishing dominates the landscape (90% of cyber crimes), more aggressive attacks like ransomware or direct hacking are still in play - especially for large firms.
"Phishing dominates the statistics because it is cheap to run at scale. That does not make it low risk - one convincing message can still open the door to fraud or account takeover."
Michael Wakefield, CTO, Beyond Encryption (Mailock)
What Does Strong Cybersecurity Protect Against?
Strong cybersecurity combines perimeter defences with detection, recovery, and repeat-incident control.
It helps you:
- Prevent unauthorised access to sensitive data.
- Detect and stop ransomware and malware before damage occurs.
- Reduce the risk of repeated crime - most affected businesses experience multiple incidents every year.
- Lower the chance that a breach will turn into fraud (like business email compromise or direct theft).
With a solid incident response plan and layered defences, you can bounce back more quickly - and limit any fallout.
Where Preparedness Falls Short
Only 22% of businesses have a formal cyber incident response plan, according to the 2024 survey.
Without a tested plan, teams often lose time deciding who owns the response when an incident lands.
Patterns, Pitfalls, and How Organisations Respond
The UK Cyber Security Breaches Survey uncovered the following patterns:
- 22% of businesses and 14% of charities fell victim to a legally-defined cyber crime in the past year. For large businesses, it's drastically higher: 58% were targeted.
- Most incidents involved phishing, but large organisations faced higher rates of hacking and ransomware.
- Victimisation is repetitive. Of those attacked, 59% had three or more crimes in a year.
- Cyber-facilitated fraud is not rare. 3% of all businesses, and 7% of large businesses, lost money in this way - usually after phishing or a hacked bank account.
Most crimes caused small or moderate losses, but for a minority the costs were crippling - especially where attacks led to fraud.
Need A Safer Way To Send Sensitive Email?
Mailock keeps email familiar while adding protected access, recipient checks, secure replies, message tracking, and sender controls.
Learn more about Mailock
When a major breach hits, organisations almost always take action - but after less serious incidents, 39% of businesses did nothing to adapt or improve controls. That gap shows how easy it is to react rather than prepare.
What The Fraud Data Shows
Around 43,000 UK businesses lost money to cyber-facilitated fraud last year, according to the 2024 survey.
Phishing and compromised accounts remain the most common routes into that kind of loss.
Best Practices for Prevention and Response
If you want to lower your risk, consider these steps:
- Train staff to spot phishing messages and suspicious websites.
- Keep software and security patches up to date.
- Use multi-factor authentication for sensitive accounts.
- Backup data (on site and in the cloud) and test restoration regularly.
- Map out an incident response plan - and run tabletop exercises to make it second nature.
- Vet supply-chain partners' security posture, too.
- Consider cyber insurance for added peace of mind.
You don't need a huge IT budget to get started - many steps are low-cost, but require consistent follow-through.
Industry and Regulatory Context
Regulators expect organisations to act responsibly.
The UK Information Commissioner's Office (ICO) and the National Cyber Security Centre (NCSC) both publish essential guidance for compliance and for security by design.
Major sectors such as finance, healthcare, and utilities face stricter controls and reporting duties.
If you operate in these fields, extra care is warranted.
Staying up to date with frameworks like Cyber Essentials should be standard practice for sensitive sectors.
Cyber Crime Prevention Starts With the Basics
Cyber crime is now routine for UK organisations, but fundamental controls still reduce most everyday risk.
Most attacks are preventable or manageable when teams keep training, patching, and response plans current.
Investing in those basics protects your business, clients, and partners before a crisis forces the issue.
Prepared teams respond faster when incidents happen - and use each breach as a chance to tighten controls.
FAQs
What Does the UK Cyber Breaches Survey Help Firms Understand?
It gives context on common attack patterns, preparedness, and the controls organisations are using to reduce cyber risk.
Why Do Basic Controls Still Matter?
Many incidents start with familiar weaknesses such as phishing, weak passwords, poor updates, or unclear response processes.
How Should Organisations Use the Survey Findings?
Use them to review training, access controls, incident response, supplier risk, and protection for sensitive communications.
References
UK Cyber Security Breaches Survey 2024, Gov.uk, 2024
Information Commissioner's Office (ICO)
National Cyber Security Centre (NCSC)
Financial Conduct Authority (FCA)
Computer Misuse Act 1990
Reviewed by
Sam Kendall, 02.06.2026
This content is for general information only and is not legal advice.
.png?)
Sam Kendall
.svg)
Previous post