A new Government report reveals little change in the cyber threat landscape with attacks regularly targeting businesses and charities in the UK.
In the UK, around two-fifths of businesses and one third of charities—equivalent to 612,000 businesses and 61,000 charities— experienced cyber security incidents in the past 12 months.
These were the disquieting figures revealed by The Cyber Security Breaches Survey 2025, commissioned by the Department for Science, Innovation and Technology (DSIT) and the Home Office and published in April 2025.
The survey estimated that 20% of businesses and 14% of charities have been victims of at least one cybersecurity incident in the past year, accounting for approximately 283,000 businesses and 29,000 charities.
Among the 43% of businesses and 30% of charities identifying any cyber security breaches or attacks, just under half (46% of businesses and 48% of charities) ended up being victims.
It is estimated that UK businesses have experienced approximately 8.58 million cyber-crimes of all types including approximately 680,000 non-phishing cyber-crimes in the last 12 months. UK charities have experienced approximately 453,000 cybersecurity incidents of all types in the last 12 months.
An estimated 3% of all businesses and 1% of all charities have been a victim of fraud that resulted from a cyber breach or attack in the last 12 months, equating to approximately 40,000 businesses and 2,000 charities.
There were an estimated 72,000 cyber-facilitated fraud events across the UK business population in the last 12 months.
Although cyber-crime overall remained fairly static in the past year, the prevalence of ransomware among businesses significantly increased.
It is estimated that around 19,000 businesses experienced a ransomware related incident in 2025, increasing from less than 0.5% in 2024 to 1% in 2025.
Phishing remained the most prevalent type of incident (comprising 93% of businesses and 95% of charities that experienced an attack), while other forms were less common.
Phishing attacks remain the most prevalent and disruptive type of breach or attack (experienced by 85% of businesses and 86% of charities). This type of attack was cited as particularly time-consuming to address due to their volume and the need for investigation and staff training.
The study also found organisations are increasingly aware that more sophisticated methods, such as AI impersonation, are becoming mainstream. AI is of growing concern in the cybersecurity world, as it is also being used to design new forms of attack on sectors such as financial services.
The average cost of each breach was calculated at £1,600 for businesses and £3,240 for charities. In the case of the most disruptive breaches the average cost rose to £3,550 for businesses and £8,690 for charities (these costs were self-reported estimates and could potentially underestimate the full financial impact).
It is important to note that these costs, which may seem moderate at first glance, represent only the immediate and direct costs of restitution. They do not include the enormous potential costs of operational interruption, reputation damage, loss of intellectual property, or other potential impacts.
The report shows the cyber threat to UK businesses and charities remains constant. Investment in more effective and resilient business cybersecurity management is paramount for every organisation—making critical system cyber protection, round the clock monitoring and defence and gaining expert advice no longer optional.
No organisation today can afford to be unprotected. Partner with Aura Technology for a more resilient, proactive approach to your cybersecurity today.
For more information click here
Want the key stats in one place? Download our infographic 🔽
