Data recovery lab, London · Mon–Sat 09:00–18:00 020 7064 4996 info@dataretrieval.org.uk

Cyber Security Breaches Survey 2026: what it means for your backups

October 28, 2026

Every year the government asks thousands of UK businesses and charities about cyber attacks. The latest results, the Cyber Security Breaches Survey 2025/2026, came out on 30 April 2026. Here are the figures that matter for your data, and what to do when things go wrong.

What the 2026 survey found

  • 43% of businesses and 28% of charities identified a cyber breach or attack in the past 12 months. The bigger the organisation, the more likely: 42% of micro businesses, 46% of small, 65% of medium and 69% of large businesses.
  • Phishing was by far the most common attack, affecting 38% of businesses.
  • Ransomware hit 1% of businesses, down from 3% in each of the previous two years.
  • 74% of businesses back up their data to a secure cloud service, compared with 57% of charities.
  • Only 25% of businesses have a formal plan for responding to an incident. For micro businesses it is 21%.

Why backups alone aren’t always enough

It’s good news that most businesses now back up to the cloud. But a backup only helps if it is complete, recent and can actually be restored. Common problems are backups that quietly stopped running months ago, a NAS that was the only backup and failed itself, or a cloud sync that copied encrypted or deleted files over the good ones.

A few simple checks make a big difference:

  • Test a restore every few months, not just the backup job. Pick a real folder and bring it back.
  • Keep one copy offline or in storage that can’t be changed, so ransomware or a mistake can’t reach it.
  • Write down who does what if a server, NAS or laptop fails: who to call, what to switch off and what not to touch. With only a quarter of businesses having a plan, this alone puts you ahead.

If the worst happens

If a drive, RAID array or NAS fails and the backup doesn’t cover it, power the device down and leave it off. Don’t run CHKDSK, First Aid or free recovery tools, and never rebuild or initialise a failed RAID. Every extra attempt can make recovery harder.

Our engineers recover data from hard drives, SSDs, RAID and NAS in our own London lab, with a cleanroom and PC-3000 equipment. You get a fixed, no-obligation quote before any recovery work starts, and we offer an emergency service for business-critical systems. Call the lab on 020 7064 4996.

Source