The key UK data breach statistics in one place — how many personal data breaches are reported to the ICO, how many businesses and charities are attacked each year, which organisations are hit hardest, and what a breach actually costs, with the data period stated next to every figure.
UK breach measures describe different things. ICO incident data covers reported personal data breaches; the government’s Cyber Security Breaches Survey measures breaches and attacks identified by businesses and charities; ONS estimates computer misuse against individuals; and NCSC records incidents it handles. IBM’s commissioned research estimates costs among participating organisations that experienced breaches. None is a complete census of all UK data breaches.
This page brings the headline numbers from each of those sources together. It is scoped to breach volumes, sectors and costs; every figure carries its data period, and every source is linked in full at the end.
Key facts and figures
- 3,677 unique personal data breach incidents appear in the ICO’s Q4 2025 trends dataset — up 16% from Q4 2024.
- 43% of UK businesses — around 612,000 firms — experienced a cyber breach or attack in the 12 months before the 2025/26 survey.
- 69% of large UK businesses experienced a breach or attack in the same period, against 42% of micro firms.
- 38% of UK businesses were hit by phishing in 2025/26 — the most common attack type by far.
- £3.13 million — the mean UK breach cost in IBM’s 2026 study of organisations that experienced a breach.
- £5.46 million — the mean financial-services breach cost in IBM’s 2026 UK findings.
- 429 incidents were handled by the NCSC from September 2024 to August 2025; the 204 nationally significant cases were up 130% in a year.
- 798,000 computer misuse incidents against adults in households in England and Wales were estimated for the year ending March 2026.
The headline measures at a glance:
| Measure | Latest figure | Data period | Trend / detail |
|---|---|---|---|
| Personal data breach reports to the ICO | 3,677 | Q4 2025 | Up 16% year on year |
| UK businesses experiencing a breach or attack | 43% (~612,000 firms) | 2025/26 survey (published April 2026) | Rises to 69% among large businesses |
| Businesses hit by phishing | 38% | 2025/26 survey | Most prevalent attack type; 25% of charities |
| Average cost of a UK data breach | £3.13 million | 2026 IBM report, July 2026 | Financial services £5.46 million |
| Incidents handled by the NCSC | 429 (204 nationally significant) | Sept 2024 – Aug 2025 | Nationally significant incidents up 130% |
| CSEW-estimated computer misuse incidents | 798,000 | Year ending March 2026 | No statistically significant annual change |
Figures were checked on 15 October 2026. The sources have different publication schedules and reference periods, so the date beside each figure matters. Later releases can also revise earlier totals.
How many data breaches are reported to the ICO?
There are 3,677 unique incident references for Q4 2025 in the ICO’s incident trends workbook, compared with 3,159 in Q4 2024, an increase of 16.4%. Organisations must notify the ICO without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to people’s rights and freedoms.
Of those Q4 2025 incidents, 2,821 were classified non-cyber (76.7%) and 856 cyber (23.3%). Non-cyber is an incident classification, not a measured human-error rate; our human error statistics guide explains that distinction.
Three details in the Q4 2025 workbook help interpret the total:
- Reported scale: 1,986 incidents, or 54%, were recorded as affecting between one and nine people. The number affected does not by itself determine the seriousness of an incident.
- Outcome timing: 1,479 incidents were still marked not yet assigned a decision in the extract. A snapshot of decisions cannot be treated as a final enforcement outcome for every report.
- Reporting times: 627 incidents were recorded in the 72-hours-to-one-week band and 680 in the more-than-one-week band. These categories alone do not establish whether the statutory notification duty was breached in an individual case.
The workbook contains repeated rows for incidents associated with different data or affected-person categories. Counts here use unique incident references. Its published trends data and the ICO’s annual personal data breach casework series have different coverage: the latter records 17,431 cases received in 2025/26. Neither should be described as every breach occurring in the UK.
How many UK businesses experience a data breach or cyber attack?
43% of UK businesses — an estimated 612,000 firms — experienced a cyber security breach or attack in the 12 months before the 2025/26 survey, according to the Cyber Security Breaches Survey published on 30 April 2026. Among charities the figure was 28%, around 57,000 organisations.
The survey was conducted for DSIT and the Home Office, with fieldwork between August and December 2025. It is an official estimate of breaches and attacks organisations identified, including attempts without a damaging outcome. Changes to survey methods mean not every earlier year is directly comparable; the report explains which comparisons are appropriate.
Phishing was experienced by 38% of businesses and 25% of charities in 2025/26 — by far the most prevalent type of breach or attack, and the one organisations consistently rate as the most disruptive to deal with.
The survey also isolates the narrower subset of incidents that meet the Home Office definition of cyber crime. 19% of businesses (about 267,000) and 14% of charities (about 28,000) were victims of at least one cyber crime in the 12 months before the 2025/26 survey. Grossed up across the economy, that equates to roughly 5.19 million cyber crimes against UK businesses and 525,000 against charities in a single year — and 93% of the businesses that experienced a cyber crime were hit by phishing.
Which businesses and sectors are hit hardest?
In the 2025/26 survey, 69% of large businesses and 65% of medium businesses identified a breach or attack, compared with 46% of small firms and 42% of micro firms. These are self-reported detection rates: size, activity and the ability to identify incidents all affect comparisons.
IBM’s 2026 UK findings put financial services at £5.46 million per breach, compared with the £3.13 million UK mean across its participating organisations. This is a cost comparison within the study, not a ranking of the number of breaches in each sector.
The ICO’s Q4 2025 trends extract records 647 incidents in health, the largest sector count, followed by education and childcare with 518 and retail and manufacture with 395. These are reported volumes rather than rates adjusted for the size of each sector; health is not an NHS-only category.
How much does a data breach cost in the UK?
IBM’s 2026 UK study reported a mean breach cost of £3.13 million, down from £3.29 million in its 2025 study. It measures costs at participating breached organisations and should not be presented as the expected cost of every incident at every UK business.
The 2026 UK release reports mean breach costs of £5.46 million in financial services, £4.23 million in services and £4.03 million in energy. Its sector estimates provide context for substantial breaches, while the government survey below captures a broader range of attacks and outcomes.
The Cyber Security Breaches Survey 2025/26 found a £0 median perceived cost for businesses’ most disruptive identified breach or attack, including respondents reporting zero cost. Among those identifying an incident with an outcome, the median was £560. A £0 median does not mean there was no disruption or harm, and it cannot be compared directly with IBM’s mean cost for a different sample of breached organisations.
How serious is the UK's wider cyber threat picture?
The NCSC handled 429 incidents between September 2024 and August 2025, including 204 nationally significant incidents, compared with 89 in the previous year. Eighteen were highly significant. These figures describe the incidents requiring NCSC support, not all cyber attacks or all ransomware incidents in the UK.
The Crime Survey for England and Wales estimated 798,000 computer misuse incidents against people aged 16 and over living in households in the year ending March 2026. There was no statistically significant change from the previous year. The survey excludes offences against businesses and people outside its household population.
The July 2026 ONS bulletin temporarily omits police-recorded fraud and cybercrime data while the City of London Police aligns legacy Action Fraud records with the new Report Fraud system. Survey estimates remain available. The different ICO, NCSC and ONS series should not be combined into a single UK trend or total.
Frequently asked questions
How many data breaches are reported to the ICO each year?
The ICO Annual Report 2025/26 records 17,431 personal data breach cases received. Separately, the latest published incident trends workbook used here contains 3,677 unique incidents for Q4 2025. These are different series and periods, so the annual total should not be reconstructed by simply adding trend-table quarters.
What was the biggest data breach in the UK?
The Capita ransomware incident in 2023 affected around 6.6 million people and resulted in combined ICO penalties of £14 million in 2025. This is a major documented incident, but a largest-ever ranking depends on whether one counts people, accounts, records, countries or different types of exposure.
What is the average cost of a data breach in the UK?
IBM reported a £3.13 million mean UK breach cost in its 2026 study, rising to £5.46 million in financial services. The government’s 2025/26 survey reported a £0 median for businesses’ most disruptive identified breach or attack, including zero-cost responses. The samples and measures differ.
Which sector has the most data breaches in the UK?
Health had the highest volume in the ICO’s Q4 2025 incident trends extract, with 647 unique incidents, followed by education and childcare with 518. These are reported counts, not breach rates adjusted for sector size, and health includes organisations beyond the NHS.
Do all data breaches have to be reported to the ICO?
No. A controller must notify the ICO unless a breach is unlikely to result in a risk to people’s rights and freedoms. Notification must be without undue delay and, where feasible, within 72 hours of awareness. All personal data breaches must still be documented, including the reason for not notifying.
Are data breaches increasing in the UK?
The answer depends on the measure. ICO trend-table incidents rose 16.4% between Q4 2024 and Q4 2025, while the ONS household survey found no statistically significant annual change in computer misuse for the year ending March 2026. These sources cover different populations and cannot establish one universal breach trend.
Related guides
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Human Error Data Breach Statistics: What the ICO Data Shows
- GDPR data breach: what to do in the first 72 hours
- GDPR fines and penalties in the UK: how big, who pays, what counts
- What is GDPR? A UK guide to the General Data Protection Regulation
- Who does GDPR apply to? Scope and enforcement in the UK
Sources & references
- ICO — data security incident trends, Q1 2019 to Q4 2025
- ICO — Annual Report 2025/26, personal data breach casework
- ICO — personal data breach reporting
- DSIT and Home Office — Cyber Security Breaches Survey 2025/26
- IBM — UK Cost of a Data Breach Report 2026 findings
- NCSC — Annual Review 2025
- ONS — Crime in England and Wales, year ending March 2026
- ICO — Capita penalty and breach findings
Most data breaches start with everyday handling mistakes — train your team to manage personal data safely and meet UK GDPR duties.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.