The shocking reason 43% of UK businesses have been hit by cyber attacks last year | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

The shocking reason 43% of UK businesses have been hit by cyber attacks last year

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Cybersecurity in the UK is often framed as a national issue, and that’s true, but that risk has never been evenly spread.

Exposure to cybercrime varies significantly between organizations, shaped less by geography and more by how businesses are structured, governed and prepared.

According to the Cyber Security Breaches Survey 2025, 43% of UK businesses and 30% of charities reported experiencing a cyber breach or attack, which translates into an estimated 8.58 million crimes against businesses and another 453,000 affecting charities.

Regulatory whiplash: Why cyber resilience is now a governance imperative

Reported ransomware incidents are just the tip of the iceberg

Alongside that, the Cifas Fraudscape 2025 Report shows that more than 421,000 fraud cases were recorded in 2024, along with billions in losses.

An interesting question is why some organizations are consistently more exposed than others.

Clear patterns begin to emerge when you look at the underlying drivers of exposure.

Regions with a high concentration of SMEs tend to carry more risk. Smaller organizations often don’t have the luxury of dedicated security teams or mature governance structures, so they move quickly, adopt new systems as they go and build complexity without always building control alongside it.

On the sector front, areas with strong footprints in financial services, retail, healthcare or education are naturally more attractive targets because of the data they hold. However, some of the most damaging incidents over the past year have taken place in less scrutinized sectors, particularly charities, nurseries and care organizations, where the data is deeply personal and the consequences far more human.

Then there’s maturity. Some regions benefit from stronger digital ecosystems, deeper talent pools and a more embedded understanding of cyber risk, whilst others are still catching up, particularly where digital transformation has outpaced governance.

Put those factors together and exposure starts to look more like a by-product of how organizations are built and managed.

AI powers innovation – but it’s also powering the next wave of cyber attacks

When confidence becomes a risk: The gap between cyber resilience readiness and reality

Over the past 12 months, we’ve seen that when something goes wrong, attention quickly shifts from how the attack happened to whether the organization had the right controls in place, whether risks were properly understood and whether recognized standards were being followed. This shift brings implications for regulation, customer trust and long-term business performance.

Of the businesses and charities who experienced at least one cyber crime in the past year, a smaller but significant proportion saw those incidents translate directly into fraud. That link between breach and financial loss is tightening, and with it, expectations around accountability.

The organizations that come through incidents strongest are those that put the structure in place long before anything goes wrong, with frameworks like ISO 27001 forcing organizations to think about risk in a systematic way. They require clear ownership, defined controls and ongoing review, not just a one-off effort, creating a baseline that can be evidenced. That distinction is becoming critical.

Businesses are now expected to prove that they take security seriously, whether that’s to a regulator, customer or investor. Without that proof, organizations are finding themselves on the back foot before an incident even occurs.

We’re also seeing this reinforced through frameworks like CAF and emerging standards around AI governance, where the expectation is demonstrable, auditable resilience.

There’s still a tendency in some organizations to treat compliance as something to be dealt with later or once growth is established, but investors wouldn’t accept weak financial controls in a business and they’re increasingly applying the same logic to cybersecurity and compliance.

Organizations with strong compliance frameworks are finding it easier to win new business, particularly in sectors where data security is critical, which opens doors to new markets and supply chains. On the other hand, those that delay are starting to feel the effect, with more questions, more friction and in some cases, missed opportunities.

The idea that some regions are ‘more at risk’ can be misleading if it’s taken at face value, because geography isn’t the root cause. What we’re really seeing is variation in how organizations approach governance, risk and compliance.

Regions with higher exposure are often home to businesses that are earlier in their maturity journey or operating in sectors where the pace of change has outstripped the controls around it. That’s important, because it means the gap is addressable.

The starting point is visibility, knowing where your risks sit and how they could materialize. What follows is the discipline to put structure around them, whether that’s through recognized frameworks, clearer ownership or more consistent oversight.

Organizations that manage incidents well have a level of preparedness that comes from having thought these scenarios through in advance. That preparation shows up in how quickly decisions are made, how clearly responsibilities are defined and how confidently the business can respond under pressure.

Compliance sits at the center of that, as a way of bringing consistency, accountability and proof into how the organization operates. The ability to evidence good practice is becoming just as important as the controls themselves.

Cyber risk may be a national conversation, but its impact is always local to the organization experiencing it. Leadership teams that recognize that, and act early, are the ones who keep control when others are trying to regain it.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

1 Google joins privacy backlash and warns Canada Bill C-22 could 'break end-to-end encryption' and create a 'surveillance infrastructure'

2i Phones could soon get a handy anti-snatching upgrade from Android

3'The internet is not connected' — Iran's 88-day blackout begins to lift, but traffic remains under 50%

4 To mark its 100th anniversary, Ducati has launched a $2,000 Nespresso machine

5 The ultimate Fitbit range guide — here are your options after the Google takeover

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards