Data recovery lab, London · Mon–Sat 09:00–18:00 020 7064 4996 info@dataretrieval.org.uk

UK cyber attacks in 2026: what the latest figures mean for your data

October 26, 2026

Two UK government reports published this year show how often British organisations are still being hit by cyber attacks, and how few are ready to recover when it happens. Here is what they say, and what it means for your data.

What the 2026 figures show

  • 43% of UK businesses and 28% of charities reported a cyber breach or attack in the last 12 months, according to the government’s Cyber Security Breaches Survey, published in April 2026.
  • Phishing was by far the most common, hitting 38% of businesses. It was also the most disruptive type of attack.
  • Only 25% of businesses have a formal plan for responding to an incident.
  • The National Cyber Security Centre (NCSC) handled 429 incidents in the year to August 2025, of which 204 were nationally significant, up from 89 the year before. That is about four a week.
  • The NCSC describes ransomware as one of the most acute threats to UK organisations, pointing to the attacks on Marks & Spencer, the Co-op and Jaguar Land Rover.

The government survey also found that fewer businesses reported ransomware this year (1%, down from 3%). That is good news, but its authors point out that the survey only counts attacks that organisations noticed and were willing to report.

Backups are the difference

The same survey found that 74% of businesses back up to the cloud and 48% back up in other ways. A backup only helps if it survives the attack. Ransomware often tries to reach backups that are connected to the same network, so keep at least one copy offline or in a separate account, and test that you can actually restore from it.

If the worst happens

  • Don’t wipe or reinstall anything until you know what can be recovered. Encrypted or damaged files, logs and old disks are often where the data is recovered from.
  • Don’t run repair tools on failing drives. If a server, NAS or RAID array has stopped working, power it down and get advice first.
  • Report it. Cyber crime in the UK can be reported to Action Fraud, and serious incidents to the NCSC.

Our London lab recovers data from failed hard drives, SSDs, RAID arrays, NAS boxes and servers, with an emergency service for business-critical systems. The initial assessment is free, and you get a fixed, no-obligation quote before any recovery work starts. Call the lab on 020 7064 4996.

Sources