Official cyber crime measures cover different populations: computer misuse experienced by adults in England and Wales, cyber incidents identified by UK organisations and incidents handled by the NCSC. Each figure below states its period and scope.
There is no single count of all UK cyber crime. The ONS household survey estimates experiences among people aged 16 and over in England and Wales. The Cyber Security Breaches Survey covers UK businesses and charities, while NCSC figures describe its own response work. Payment-fraud and Cifas member data provide additional, distinct context.
Key facts and figures
- 798,000 computer misuse incidents were estimated by the CSEW in the year ending March 2026, with no statistically significant annual change.
- 3.8 million fraud victims were estimated by the CSEW in England and Wales in the year ending March 2026, up 10% on the previous year.
- 55% lower — estimated CSEW computer misuse incidents in the year ending March 2026 compared with the earliest comparable year, ending March 2017.
- 4.5 million fraud incidents were estimated by the CSEW in the year ending March 2026, with no statistically significant annual change.
- 43% of UK businesses — around 612,000 firms — identified a cyber breach or attack in 2025/26; 28% of charities (CSBS 2025/26).
- 19% of UK businesses were victims of at least one cyber crime in 2025/26 — roughly 267,000 firms (CSBS 2025/26).
- 204 “nationally significant” cyber attacks were handled by the NCSC in the 12 months to August 2025 — up 130% and about four a week (NCSC Annual Review 2025).
- 444,000+ cases were filed to CIFAS's National Fraud Database in 2025 — a record, with identity fraud the largest category (CIFAS Fraudscape 2026).
Checked on 15 October 2026. The latest ONS crime bulletin covers the year ending March 2026. The business survey was conducted in August–December 2025, and the NCSC Annual Review 2025 covers September 2024–August 2025. These series are not directly comparable.
How much cyber crime is there in the UK each year?
The CSEW estimated 798,000 computer misuse incidents against adults in England and Wales in the year ending March 2026. The annual difference was not statistically significant. The survey includes experiences whether or not reported to police, but excludes businesses, tourists, people under 16 and residents of communal establishments.
The same survey estimated 4.5 million fraud incidents and 3.8 million fraud victims. Incident numbers showed no statistically significant annual change, while victim numbers increased by 10%. Fraud includes offences that are not cyber-dependent, and one person can experience several incidents.
For UK organisations specifically, the government's Cyber Security Breaches Survey is the reference point: 43% of businesses and 28% of charities identified a breach or attack in the 12 months to the 2025/26 survey — equivalent to roughly 612,000 businesses and 57,000 charities. That headline is unpacked in full further down this page.
What is computer misuse and how is it measured?
Computer misuse is the offence category the ONS uses for cyber-dependent crime — offences that can only be committed using a computer, such as hacking, unauthorised access to accounts, and computer viruses or malware. It sits under the Computer Misuse Act 1990 and is measured two ways, which is why the figures can look contradictory.
The CSEW distinguishes unauthorised access to personal information from computer viruses. Its combined estimate was 798,000 computer misuse incidents in the year ending March 2026. It provides evidence about its covered household population, not all UK organisations or every type of digital harm.
Police-recorded figures measure reported and recorded offences, with a wider population but different limitations. The July 2026 ONS bulletin temporarily omits recorded fraud and cybercrime while City of London Police transitions legacy data to Report Fraud. That omission does not mean that no offences occurred or were reported.
| Measure | Latest figure | Change on prior year | Source & period |
|---|---|---|---|
| Computer misuse incidents (CSEW) | 798,000 | No significant change | CSEW, England and Wales, YE March 2026 |
| Fraud victims (CSEW) | 3.8 million | +10% | CSEW, England and Wales, YE March 2026 |
| Fraud incidents (CSEW) | 4.5 million | No significant change | CSEW, England and Wales, YE March 2026 |
| UK businesses identifying a breach or attack | 43% | Different series from household crime | CSBS 2025/26, preceding 12 months |
| Nationally significant attacks (NCSC) | 204 | +130% | NCSC, 12 months to Aug 2025 |
The table combines distinct measures for comparison of scope. It is not an additive total of crime: incidents, victims, organisations and national-response cases have different denominators.
Is UK cyber crime going up or down?
The latest CSEW estimate does not show a statistically significant annual change in computer misuse. It is around 55% below the year ending March 2017, the earliest comparable survey year. This supports a longer-term fall in that measure, not a claim that every form of cyber crime is currently declining.
Fraud incident numbers also showed no statistically significant annual change, although the number of victims rose 10% to 3.8 million. Recorded fraud and cybercrime are temporarily absent from the latest ONS release during the reporting-system transition. Changes in an older recorded series should not be presented as current household-survey trends.
UK Finance members reported £1.28 billion lost to payment fraud in 2025, 4% more than in 2024, in the Annual Fraud Report 2026. This covers payment-fraud categories reported by participating financial providers. It is not a total cost of cyber crime or directly comparable with CSEW incident estimates.
How many UK businesses and charities are breached?
43% of UK businesses and 28% of charities identified a cyber security breach or attack in the 12 months to the 2025/26 Cyber Security Breaches Survey (fieldwork August to December 2025). That scales to roughly 612,000 businesses and 57,000 charities. Not every breach amounts to a crime: 19% of businesses (about 267,000) and 14% of charities (about 28,000) were victims of at least one cyber crime over the same period, once the survey applies its stricter Home Office Counting Rules definition.
In the 2025/26 business survey, 38% of all businesses identified phishing and 1% identified ransomware during the preceding 12 months. These are shares of all businesses, not shares of reported ICO breaches. An identified attack does not necessarily cause loss or meet the survey’s crime definition.
How many nationally significant attacks does the NCSC handle?
The NCSC handled 204 nationally significant incidents in September 2024–August 2025, compared with 89 in the preceding year: a rise of about 130%, or roughly four per week. These are severity-classified cases in its operational workload, not a survey estimate of all serious attacks in the country.
The NCSC handled 429 incidents in total during that review year, including the 204 nationally significant incidents. It received 1,727 incident reports. Reports, handled incidents and the nationally significant subset must not be added together as independent counts.
How much is lost to fraud and identity crime?
Cifas members filed more than 444,000 fraud-risk cases to the National Fraud Database in 2025, up 6%. More than 242,000 concerned identity fraud, about 54% of filings. This is a member-reported database, not a complete national count of crimes or unique victims; changing detection and reporting also affect the totals.
UK Finance’s latest full-year figure is £1.28 billion in payment-fraud losses in 2025, up 4%. It includes authorised and unauthorised payment fraud, which can involve deception as well as technical compromise. These losses cannot be added to Cifas filings or treated as losses caused solely by hacking.
What replaced Action Fraud for reporting cyber crime and fraud?
Report Fraud replaced Action Fraud as the reporting service for fraud and cyber crime in England, Wales and Northern Ireland, launching on 4 December 2025. People in Scotland should report to Police Scotland. Historical reports can retain the former service name because it was used during their data period.
The ONS July 2026 bulletin explains that recorded fraud and cybercrime data are temporarily omitted while legacy records are aligned with the new service. The CSEW estimates remain available. Readers should therefore use the stated source and period rather than assuming an old Action Fraud count is the latest national total.
Frequently asked questions
How much cyber crime is there in the UK each year?
There is no complete single total. The CSEW estimated 798,000 computer misuse incidents among adults in England and Wales in the year ending March 2026. Separately, 43% of UK businesses identified a cyber breach or attack in the preceding 12 months in the 2025/26 business survey.
What is computer misuse and how is it measured?
Computer misuse includes hacking, unauthorised access and computer viruses. The CSEW estimates experiences among household residents aged 16 and over in England and Wales; police data cover reported and recorded offences. Recorded fraud and cybercrime are temporarily omitted from the July 2026 ONS bulletin during a system transition.
Is UK cyber crime going up or down?
The year-ending-March-2026 CSEW showed no statistically significant annual change in computer misuse or fraud incident numbers. Computer misuse was about 55% below the earliest comparable year, ending March 2017. Other sources and populations can show different trends.
What replaced Action Fraud for reporting cyber crime and fraud?
Report Fraud launched on 4 December 2025, replacing Action Fraud for fraud and cyber crime reports in England, Wales and Northern Ireland. Scotland uses Police Scotland. ONS recorded fraud and cybercrime figures are temporarily omitted during the data transition; household-survey estimates continue.
How many serious cyber attacks does the UK face?
The NCSC handled 429 incidents in September 2024–August 2025, including 204 classified as nationally significant. The latter count rose from 89 the year before. It is a subset of the 429, not an additional count, and neither figure measures every attack in the UK.
Related guides
- Phishing statistics UK
- Ransomware statistics UK
- Data breach statistics UK
- ICO complaints statistics UK
- Cyber security skills gap statistics UK
- GDPR data breach: what to do in the first 72 hours
Sources & references
- ONS — Crime in England and Wales, year ending March 2026
- DSIT and Home Office — Cyber Security Breaches Survey 2025/26
- NCSC — Annual Review 2025, September 2024–August 2025
- UK Finance — Annual Fraud Report 2026, payment fraud in 2025
- Cifas — Fraudscape 2026, member filings in 2025
- City of London Police — Report Fraud
Most cyber crime that reaches UK organisations starts with a person — a clicked link, a reused password, a mishandled record. Train your team to recognise the threats and handle personal data safely.
Explore the GDPR & Data Protection Course →
Mark writes about GDPR, data protection and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.