Data breaches remain one of the most common cyber risks facing UK organisations

Rising cyber threats highlight urgent need for resilience across British businesses

Data breaches continue to rank among the most persistent and widespread cyber risks confronting UK organisations, with new government figures revealing that a significant proportion of businesses are still being targeted each year.

According to the latest findings from the UK government’s Cyber Security Breaches Survey 2025, around 43% of UK businesses reported experiencing a cyber security breach or attack in the last 12 months, equating to more than 600,000 organisations nationwide.

Despite increased awareness and investment in digital security, experts warn that these figures demonstrate a continuing and evolving threat landscape—one that is affecting organisations of all sizes and sectors.

A persistent and evolving cyber risk

The data underscores a clear trend: cyber breaches are no longer isolated incidents but a routine risk of doing business in a digital economy.

Medium and large organisations remain particularly vulnerable. Government figures show that up to 74% of large businesses and 67% of medium-sized firms have experienced breaches, highlighting how increased digital infrastructure and data volumes can attract attackers.

Phishing attacks remain the most common entry point for cybercriminals, affecting 85% of organisations that suffered a breach, often through increasingly sophisticated social engineering tactics.

Meanwhile, the Information Commissioner’s Office (ICO) continues to record thousands of reported data security incidents annually, reinforcing the scale of the challenge and the regulatory requirement for organisations to report breaches within strict timeframes.

High-profile incidents and growing financial impact

Recent cyber incidents involving well-known UK brands have brought the issue further into the public spotlight. Retailers including Marks & Spencer, Co-op, and Harrods have all faced major cyberattacks, with some reporting significant financial and operational disruption.

The financial implications are growing. The Association of British Insurers (ABI) reports that UK insurers paid approximately £197 million in cyber-related claims in 2024, a 230% increase year-on-year, as ransomware and malware attacks surged.

This rise in claims highlights how cyber incidents are no longer just an IT issue but a critical business risk impacting revenue, customer trust, and long-term resilience.

Businesses urged to strengthen cyber defences

Cybersecurity specialists warn that many organisations still underestimate the complexity of modern attacks. While there has been some improvement in basic protections—often referred to as “cyber hygiene”—gaps remain in detection, response, and employee awareness.

A growing concern is the role of emerging technologies such as artificial intelligence, which are making attacks faster, more targeted, and harder to identify. At the same time, only a fraction of organisations adopting AI report having appropriate security measures in place.

Regulatory pressure is also increasing. New rules being introduced by UK authorities will require stricter reporting, greater oversight of third-party suppliers, and enhanced resilience planning—placing further responsibility on organisations to proactively manage cyber risk.

The role of insurance in managing cyber risk

As cyber threats continue to evolve, insurance providers are playing an increasingly important role in helping businesses manage their exposure.

Modern insurance policies are no longer limited to financial cover. Many now include access to preventative tools, incident response teams, and expert guidance to support organisations before, during, and after a breach.

For businesses seeking practical ways to protect themselves, guidance and support are available through providers such as Swinton Business Insurance, which offers insights into risk management and protection strategies tailored to a rapidly changing threat landscape.

A call to action for UK organisations

The message from experts is clear: data breaches are not going away. While the overall proportion of businesses reporting incidents has fluctuated slightly year-on-year, the underlying risk remains high—and in many cases, more sophisticated.

• With cyber threats becoming more targeted and regulatory expectations rising, organisations are being urged to:
• Invest in robust cybersecurity systems and regular updates
• Train employees to recognise phishing and social engineering attacks
• Develop incident response and recovery plans
• Review insurance coverage to mitigate financial risk

As the digital economy continues to expand, cyber resilience is becoming a defining factor in business success. For UK organisations, the challenge is no longer whether they will face a cyber threat—but how well prepared they are when it happens.