What counts as a breach or attack
The survey counts any breach or attack a business noticed, from a fake email that reached staff to someone getting into an account. Viruses, hacked accounts and attempts to break in all count. Some do no harm. Others stop work or cost money.
Why the real number may be higher
A business can only report what it notices. A firm that does little checking may miss attacks, so the true share could be higher. Either way, attacks are common, not rare. Plan as if one will reach you this year, and decide now who deals with it.
What to do first
Most attacks start with a fake email, so start there:
- Turn on two-step sign-in for every email account.
- Show staff what a fake email looks like, and who to tell.
- Set up SPF, DKIM and DMARC on your domain.
- Keep backups apart from your main systems, and test them.
Sources
- Cyber Security Breaches Survey 2025. Department for Science, Innovation and Technology. Published 2025.
Last checked: 4 October 2026.