43% of UK businesses had a cyber breach last year. Here's what the government's survey says

The government's latest Cyber Security Breaches Survey found that 43% of UK businesses, around 612,000, had a breach or attack in the past year. Phishing was by far the most common.

The Zopi team
October 2026 · 3 min read

The UK government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that just over four in ten businesses (43%) had a cyber security breach or attack in the previous 12 months. That's around 612,000 UK businesses.

Key figures from the survey: 43% of businesses had a breach or attack, rising with size from 42% of micro to 69% of large businesses; 38% experienced phishing; 47% use two-factor authentication; 5% hold Cyber Essentials — Key figures from the Cyber Security Breaches Survey 2025/2026 (GOV.UK).

The headlines

Phishing is still the biggest problem. It was by far the most common type of breach or attack, experienced by 38% of businesses
The bigger the business, the bigger the target: 42% of micro businesses, 46% of small, 65% of medium and 69% of large businesses reported a breach or attack
Impersonation fell to 12% of businesses, and ransomware to 1%, down from 3% in each of the previous two years
Only 47% of businesses use two-factor authentication, one of the simplest ways to stop a stolen password being used
Just 5% hold Cyber Essentials, the government-backed certification, up from 3% last year. Only 17% have heard of it

Small businesses are slipping on the basics

The survey found fewer small businesses doing the groundwork than the year before:

Cyber security risk assessments fell from 48% to 41%
Formal cyber security policies fell from 59% to 52%
Business continuity plans that cover cyber attacks fell from 53% to 44%

Across all businesses, only 30% had assessed their cyber security risks in the last year, a quarter (25%) had an incident response plan, and in 31% someone on the board was responsible for cyber security.

Why this matters for a small business

It's easy to think attackers only go after big names. The survey suggests otherwise: more than four in ten micro and small businesses reported a breach or attack, and most of it starts with something as ordinary as a convincing email. The good news is that the things that help most are cheap and quick to do.

Five things worth doing this month

Turn on two-factor authentication for email, Microsoft 365 and anything else that supports it
Help your team spot phishing: a short refresher costs far less than a breach
Check your backups actually restore, and keep a copy that ransomware can't reach
Protect servers you can reach remotely, so password-guessing attacks are blocked automatically
Look at Cyber Essentials: it covers the basics, and many insurers and customers now expect it

How Zopi can help

Our managed IT support, cybersecurity and backup services cover all five, and Zopi Guard blocks password-guessing attacks on Windows servers, with a shared block list that warns every server about attackers seen elsewhere. Call us on 0204 502 1288 for a no-obligation chat.