The United Kingdom's latest government Cyber Security Breaches Survey, published Thursday, shows that an estimated 612,000 businesses reported at least one cyber breach or attack during the last 12 months. The headline finding: 43% of businesses experienced a breach or attack in 2025/26, an unchanged rate from 2024/25.
The survey identifies phishing as the most commonly reported type of incident, affecting 38% of businesses - the same proportion recorded in the prior year. The data also points to a reduction in overall reported breaches compared with 2023/24, when half of businesses - 50% - said they had experienced a breach or attack.
Government officials are urging corporate leaders to take further action to shore up defences. Britain’s minister for cyber security emphasized that artificial intelligence is amplifying the threat landscape and called on businesses to respond accordingly. That public admonition follows other recent government-level warnings: the head of the UK cyber security agency signalled last week that cyber attacks potentially connected to hostile states could increase, and ministers issued an open letter to businesses addressing AI-related cyber threats.
While the survey quantifies the incidence of breaches and highlights phishing as the prevalent method, the published material does not provide additional breakdowns of sectoral impact, cost burdens, or remediation outcomes beyond the figures cited above. As a result, the broader economic and market implications remain described in general terms by officials rather than detailed in the survey results made public on Thursday.
Taken together, the survey and subsequent government statements underline two persistent themes: the steady share of businesses reporting cyber incidents year-on-year from 2024/25 to 2025/26, and the continuing prominence of phishing as an attack vector. Officials also link the evolving role of AI and possible state-linked activity to a more severe threat environment, prompting calls for heightened vigilance among business leaders.
Readers should note that the publicly released survey numbers form the basis of the reporting above; where the published material is limited, that limitation is reflected rather than supplemented with additional detail.