UK ransomware statistics covering reported breaches, business survey prevalence, payment behaviour, recovery costs and documented incidents. Each measure has its own period and population.
Ransomware can disrupt services and expose personal data. The figures here combine NCSC operational reporting, government business surveys, ICO incident data and clearly identified research from Sophos and Databarracks. They do not provide one complete count of every UK ransomware attack.
The page covers incident measures, payment research, recovery costs, historical case studies and proposals concerning ransom payments. Legislative proposals are distinguished from current duties. Sources are collected at the end.
Key facts and figures
- 204 nationally significant cyber incidents of all types were handled by the NCSC from September 2024 to August 2025, up from 89; this is not a ransomware count.
- 1% of UK businesses identified ransomware in the previous 12 months in the 2025/26 survey, down from 3% in each of the preceding two surveys.
- 617 ransomware incidents appear in the ICO’s 2025 dataset, compared with 752 in 2024, counting each incident reference once.
- 18% of ransomware-affected respondents in Databarracks’ 2026 UK survey said they paid; this is a survey subgroup, not a count of all UK victims.
- $2.5 million was the median ransom demand in Sophos’s 2026 UK research among affected organisations; amounts are in US dollars.
- $1.49 million was the mean recovery cost excluding ransom payments in Sophos’s 2026 UK survey.
- £270 m–£440 m was the Cyber Monitoring Centre’s June 2025 estimate of UK impact from the combined M&S and Co-op event, not a final audited loss.
- £14 million — the ICO fine issued to Capita in October 2025 after a ransomware breach affecting 6.6 million people.
The headline measures at a glance:
| Measure | Latest figure | Data period | Trend / detail |
|---|---|---|---|
| Nationally significant cyber incidents of all types | 204 | September 2024–August 2025 | Up from 89; includes attack types other than ransomware |
| UK businesses experiencing ransomware | 1% | 2025/26 survey (published April 2026) | Down from 3% in 2024/25 and 2023/24 |
| Ransomware incidents in the ICO dataset | 617 | 2025 calendar year | 752 in 2024; unique incident references |
| Affected survey respondents who paid a ransom | 18% | Databarracks 2026 UK survey | Rounded from 17.6%; 17% in its 2025 survey |
| Median ransom demand, UK survey | $2.5 m | Sophos 2026; US dollars | Survey of affected organisations with 100–5,000 employees |
| Mean UK survey recovery cost, excluding ransom | $1.49 m | Sophos 2026; US dollars | Includes downtime and other recovery costs |
| Estimated impact of the M&S/Co-op event | £270m–£440m | June 2025 (Cyber Monitoring Centre) | Dated modelled assessment; broader than the two companies’ own losses |
| Capita ransomware-related ICO fine | £14m (Capita) | October 2025 | 6.6 million people's data affected |
Checked on 15 October 2026. ICO figures cover calendar 2025; the business survey was conducted in August–December 2025. The NCSC review covers September 2024–August 2025. Industry surveys and historical cases retain their own dates and definitions.
How many ransomware attacks happen in the UK each year?
The NCSC handled 204 nationally significant cyber incidents from September 2024 to August 2025, compared with 89 in the preceding review period. These incidents span different attack types. The increase cannot be described as a 130% rise in ransomware attacks.
There is no single official count of every UK ransomware attack, so the honest answer comes from reading three official lenses together, each measuring a different slice of the problem:
- NCSC operational figures describe incidents handled at a national level. The 204 nationally significant incidents are part of its wider cyber incident workload and are not an annual ransomware total.
- The ICO dataset contains 617 distinct ransomware incident references in 2025, compared with 752 in 2024 and 1,253 in 2023. It covers reports reaching the regulator, not every ransomware attack. Rows describing different data types or affected groups are deduplicated.
- The Cyber Security Breaches Survey found that 1% of UK businesses identified ransomware in the previous 12 months. Interviews took place in August–December 2025 and the 2025/26 results were published in April 2026. Undetected or unreported experiences are not captured.
A ransomware incident may be a personal data breach even if information is not stolen, for example where availability is lost. Controllers must notify the ICO without undue delay and within 72 hours of awareness where feasible, unless the breach is unlikely to risk people’s rights and freedoms. All personal data breaches must be documented; notification is not required for every ransomware incident regardless of circumstances.
Is ransomware in the UK rising or falling?
The latest business survey found lower ransomware prevalence: 1%, compared with 3% in each of the preceding two surveys. ICO ransomware reports also fell from 752 in 2024 to 617 in 2025. The NCSC’s increase in nationally significant incidents concerns all cyber attack types and cannot reverse those ransomware-specific findings.
These sources measure different populations, reporting thresholds and periods. Their figures cannot establish that fewer attacks are becoming more targeted or more severe. Serious individual incidents can occur even when a particular survey estimate or report count falls.
The 2025/26 survey reported ransomware cyber crime against 1% of charities, compared with a rounded figure below 0.5% previously. Rounded small percentages do not support an exact claim that the rate doubled.
For wider context, 43% of UK businesses, approximately 612,000, identified a cyber breach or attack of some kind in the 2025/26 survey. That includes attempted attacks and is broader than cyber crime. The separate estimate of 5.19 million cyber crimes counts incidents, so it should not be compared directly with a percentage of businesses.
What percentage of UK ransomware victims pay the ransom?
Databarracks’ 2026 Data Health Check surveyed 500 UK IT professionals. Among the 125 reporting ransomware in the previous year, 17.6% said they paid, rounded to 18%. The corresponding published percentages were 17% in 2025, 27% in 2024 and 44% in 2023. These are results from the survey’s affected subgroup, not a national payment register.
In the same 2026 affected subgroup, 59.2% said they recovered from backups without paying, rounded to 59%. Backup recovery and ransom payment are different response options; these results do not measure the proportion of all UK organisations with a formal never-pay policy.
Sophos’s separate 2026 UK research reported a median ransom demand of $2.5 million. It surveyed 120 IT and cyber leaders at organisations with 100–5,000 employees that had experienced ransomware, during January–March 2026. Its figures use US dollars and should not be treated as estimates for every UK business.
How much does a ransomware attack cost a UK business?
Sophos’s 2026 UK survey reported a mean recovery cost of $1.49 million, excluding ransom payments. It includes downtime, staff time, devices, network costs and lost opportunity. Fifty-five per cent recovered within a week, while 16% took between one and six months. A mean cost is not a typical bill that every affected business should expect.
Compromised credentials were the most frequently reported technical root cause in that UK survey at 28%, followed by malicious email at 25% and phishing at 22%. Exploited vulnerabilities accounted for 18%. The findings concern the surveyed affected organisations, not all UK ransomware incidents.
The Cyber Monitoring Centre’s 20 June 2025 assessment treated the M&S and Co-op attacks as one Category 2 event and estimated UK financial impact of £270 million to £440 million. This was a modelled assessment at that date, including effects beyond the retailers themselves, rather than a final audited loss or a ransom-payment total.
What do major UK ransomware incidents illustrate?
These four historical cases illustrate regulatory findings and service or economic disruption. Different measures of impact prevent a reliable single ranking of the most damaging attacks.
| Incident | When | What happened | Impact | Outcome |
|---|---|---|---|---|
| Capita | March 2023 | Black Basta ransomware; the compromised device went unquarantined for 58 hours | 6.6 million people's data exposed | £14m ICO fine (£8m Capita plc + £6m Capita Pension Solutions), 15 October 2025 |
| Advanced Computer Software | August 2022 | LockBit ransomware, entering via a customer account without MFA | NHS services disrupted; 79,404 affected people recorded, with possible duplicates noted | £3,076,320 final ICO fine, March 2025 |
| M&S and Co-op | Spring 2025 | Linked ransomware attacks classified by the CMC as a single systemic event | Weeks of retail disruption across both groups | £270m–£440m estimated UK impact (CMC, June 2025) |
| Synnovis | June 2024 | Ransomware disrupted pathology services used by NHS providers | Government later reported delays to more than 11,000 appointments and procedures | November 2025 statement cited £32.7 m impact on Synnovis and a contribution to one patient’s death |
The Capita and Advanced cases concerned failures to meet data protection security duties. An organisation is not automatically fined merely because criminals attack it; the regulator considers the facts and applicable obligations. Security controls, response arrangements and the risk-based breach reporting duty all matter.
Will it become illegal to pay a ransom in the UK?
In July 2025 the Home Office set out proposals for a targeted payment ban covering the public sector and regulated critical national infrastructure, together with a ransomware reporting regime. These were proposals requiring legislation and further work on scope. They should not be presented as an already applicable ban or a universal ransomware reporting deadline.
Ransom payments can breach financial sanctions where they involve a designated person or entity, including through indirect provision of funds. OFSI’s January 2026 guidance explains the relevant risks. The government does not encourage payment, and payment does not guarantee recovery or prevent later disclosure of stolen information.
The proposed payment restrictions and reporting system have a different purpose and scope from existing UK GDPR personal data breach duties. Organisations should check the law applicable to their circumstances and obtain appropriate advice rather than infer a duty from a survey statistic or consultation proposal.
Frequently asked questions
How many ransomware attacks happen in the UK each year?
There is no complete official count. The ICO dataset contains 617 distinct ransomware incident references in 2025, while 1% of UK businesses identified ransomware in the 2025/26 survey. The NCSC’s 204 nationally significant incidents for September 2024–August 2025 include all cyber attack types.
What percentage of UK ransomware victims pay the ransom?
In Databarracks’ 2026 survey, 17.6% of the 125 ransomware-affected respondents said they paid, rounded to 18%. Another 59.2% reported backup recovery without paying. This subgroup of a 500-person UK IT survey is not a census of UK victims.
How much does a ransomware attack cost a UK business?
Sophos’s 2026 UK survey reported a mean recovery cost of $1.49 million excluding ransom payments. Its sample comprised 120 affected organisations with 100–5,000 employees and figures are in US dollars. Individual costs vary substantially.
Is it illegal to pay a ransomware ransom in the UK?
Payments can breach financial sanctions, and the government does not encourage paying. The Home Office’s July 2025 response proposed a targeted public-sector and regulated critical-infrastructure ban and incident reporting regime; those proposals should not be confused with existing law or the separate UK GDPR reporting threshold.
How much did the M&S cyber attack cost?
The Cyber Monitoring Centre’s June 2025 model estimated £270 million to £440 million of UK impact from the combined M&S and Co-op event. It is not an M&S-only cost or a final audited figure.
What is the most common cause of UK ransomware attacks?
In Sophos’s 2026 UK survey of affected organisations, compromised credentials were the most common technical root cause at 28%, followed by malicious email at 25% and phishing at 22%. These results do not establish a cause distribution for every UK incident.
Related guides
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Phishing Statistics UK: Attacks, Trends & Costs
- Human Error Data Breach Statistics: What the ICO Data Shows
- GDPR data breach: what to do in the first 72 hours
- GDPR fines and penalties in the UK: how big, who pays, what counts
Sources & references
- NCSC — Annual Review 2025, September 2024 to August 2025
- DSIT and Home Office — Cyber Security Breaches Survey 2025/2026
- ICO — Data Security Incident Trends, distinct incident references
- Databarracks — Data Health Check 2026, 500 UK IT professionals
- Sophos — State of Ransomware in the UK 2026, 120 affected organisations
- ICO — Capita £14 million fine, October 2025
- ICO — Advanced final penalty, March 2025
- Cyber Monitoring Centre — June 2025 assessment of the M&S and Co-op event
- UK Government — Synnovis written statement, November 2025
- Home Office — Response to ransomware legislative proposals, July 2025
- OFSI — Financial sanctions guidance for ransomware, January 2026
- ICO — Personal data breach reporting
Ransomware gets in through everyday mistakes — a missed update, a weak password, a convincing email. Train your team to handle data safely and meet UK GDPR duties.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.