Key Takeaways
• The NCSC recorded 204 nationally significant cyber incidents in 2024/25 – a 130% increase on the previous year.
• 58% of UK business leaders now rank cyber breaches as a top risk for 2026.
• The Cyber Security and Resilience Bill is expected to become law later this year, introducing stronger reporting requirements and higher penalties.
• AI-powered attacks are growing in both volume and sophistication, lowering the barrier for cybercriminals.
• Ransomware attacks on major UK retailers in 2025 cost an estimated £270m to £440m, with one retailer alone expecting a £300m profit hit.
• Businesses that take a proactive approach to security stand a far better chance of avoiding costly disruption.
If 2025 taught us anything, it’s that no business is too big or too small to fall victim to a cyber attack. Major high street retailers and manufacturers were brought to their knees by ransomware, with combined losses running into hundreds of millions of pounds.
And the threat is only growing. The NCSC’s Annual Review 2025 painted a stark picture: the UK faced 204 nationally significant cyber incidents between September 2024 and August 2025 – a 130% increase on the previous year and the highest number ever recorded. “Highly significant” incidents, those with serious impact on government, essential services, or the economy, rose by 50% for the third consecutive year.
NCSC CEO Richard Horne was blunt in his assessment: “Cyber security is now a matter of business survival and national resilience.”
So what’s changed since last year, and what should your business be doing about it right now? Here’s everything you need to know.
What’s Changed Since 2025
Ransomware Hit the High Street – Hard
The spring 2025 ransomware campaign against UK retailers was a wake-up call for every business in the country. Over the Easter weekend, one of the UK’s largest retailers suffered a devastating attack. Online orders were suspended for 46 days, automated stock systems were knocked offline, and staff had to revert to pen and paper to manage supply chains. The company estimated the impact at £300m in lost operating profit.
A major national supermarket chain was hit at the same time. Although their IT team acted quickly to take systems offline and limit the damage, attackers had already stolen data affecting 6.5 million customers. Several other well-known brands were also targeted in the same wave of attacks. The Cyber Monitoring Centre estimated the combined financial impact on just two of the affected retailers at between £270m and £440m.
Later in the year, a major UK manufacturer suffered what has been described as the most economically damaging cyber incident in UK history, with an expected cost of £1.9 billion and over 5,000 businesses across its global supply chain affected.
State-Backed Threats Are Increasing
The NCSC’s Annual Review identified China, Russia, Iran, and North Korea as the most significant state-sponsored threat actors targeting the UK. Russian-aligned hacktivist groups continue to target local government and critical national infrastructure with denial-of-service attacks, with a fresh NCSC warning issued in January 2026. Just days ago, the NCSC issued further guidance urging critical infrastructure operators to prepare for “severe” cyber attacks, following a coordinated malware attack on Poland’s energy infrastructure in December.
AI Is Changing the Game for Attackers
Threat actors are now using AI and large language models to generate convincing phishing campaigns at scale, automate stages of cyber attacks, and identify vulnerabilities faster than ever before. The NCSC has warned that AI is lowering the barrier to entry for cybercriminals, meaning even less-skilled attackers can now launch effective campaigns.
New Legislation Is Coming
The Cyber Security and Resilience Bill passed its second reading on 6 January 2026 and is expected to become law later this year. It will expand the scope of regulated sectors, introduce mandatory 24-hour incident notification windows, include ransomware attacks as reportable incidents, and give regulators stronger enforcement powers with penalties of up to £17m or 4% of global turnover. Even if your business isn’t directly in scope, the ripple effects through supply chains mean this legislation will affect almost everyone.
The Numbers You Need to Know
| Statistic | Source |
| 43% of UK businesses experienced a cyber breach or attack in the past 12 months | CSBS 2025 |
| 70% of medium businesses and 74% of large businesses were affected | CSBS 2025 |
| 204 nationally significant incidents handled by the NCSC (up 130%) | NCSC Annual Review 2025 |
| 58% of UK business leaders rank cyber breaches as a top risk | Nardello & Co, Jan 2026 |
| 75% of business leaders doubt their firm’s ability to manage cyber threats | Nardello & Co, Jan 2026 |
| 84% of UK CISOs consider their business at high risk of a material attack | Proofpoint/Statista |
| The average business faces around 30 cyber crimes per year | CSBS 2025 |
| Ransomware attacks on major UK retailers cost an estimated £270m–£440m | Cyber Monitoring Centre |
Your 2026 Security Action Plan
The NCSC continues to publish specific guidance for heightened threat periods. Here are the actions every business should be taking right now.
1. Patch and Update Everything
Unpatched software remains one of the most common ways attackers gain access. Check for pending updates across your entire infrastructure and apply them as a matter of urgency. A few minutes of planned downtime is nothing compared to weeks of disruption following a breach.
2. Lock Down Access Controls
Several of the 2025 retail attacks involved social engineering of IT help desks to gain initial access. Review who has access to your systems, enforce unique credentials for every user, remove access promptly when staff leave, and apply the principle of least privilege – giving people only the access they need to do their jobs.
3. Enforce Multi-Factor Authentication (MFA) Everywhere
If you do one thing after reading this, make it this. MFA blocks the vast majority of unauthorised access attempts, even when passwords have been compromised. Enable it on all accounts, particularly those with access to sensitive systems or data.
4. Verify Your Backups Can Actually Restore
Follow the 3-2-1 backup rule: at least three copies of your data, on two different types of storage, with one copy stored offsite or in the cloud. Critically, test your backups regularly. Too many businesses discover their backups are faulty only when they desperately need them. Consider immutable backups that cannot be altered by ransomware.
5. Train Your People
With around 90% of cyber incidents resulting from human error, regular training is not optional. Show your team real examples of current phishing attempts and social engineering tactics. Make security part of your culture, not just a policy document gathering dust.
6. Have an Incident Response Plan Ready
Who do you call if you’re hit tomorrow morning? What’s the plan for keeping operations running? If you’re scrambling for answers, you need to fix that now. The NCSC provides free resources including Exercise in a Box to help you rehearse your response to common scenarios. The 2025 retail attacks showed that businesses with clear response plans and the ability to take fast, decisive action fared significantly better than those without.
7. Audit Your Supply Chain
54% of large organisations cite supply chain challenges as their biggest barrier to cyber resilience. One of the 2025 attacks affected over 5,000 businesses across a single manufacturer’s global supply chain, showing just how devastating a breach at one link can be. Know who has access to your systems, audit third-party connections regularly, and encourage suppliers to achieve Cyber Essentials certification.
8. Monitor Your Systems Around the Clock
You cannot defend against threats you cannot see. Enable logging across your systems and consider 24/7 security monitoring – attacks do not follow business hours. The NCSC offers a free Early Warning Service that alerts you to threats, with over 8,500 UK organisations already signed up.
Free Resources You Should Be Using
The UK government provides extensive free cyber security resources that many businesses overlook:
- Cyber Essentials certification – A government-backed scheme demonstrating you meet baseline security standards. Organisations with under £20m turnover also receive free cyber liability insurance.
- NCSC’s 10 Steps to Cyber Security – A guidance framework covering everything from risk management to incident response.
- NCSC Early Warning Service – Free threat alerts already used by over 8,500 UK organisations.
- Exercise in a Box – Free scenario-based tool to rehearse your response to common cyber threats.
- Cyber Governance Code of Practice – New guidance helping boards implement oversight of cyber risks.
- Action Fraud – The official channel for reporting cyber crime.
Links to all resources can be found in the sources section below
Don’t Wait for a Wake-Up Call
The businesses that came through 2025 in the best shape were those that had already invested in their defences before an attack came. The ones that suffered most were those that assumed it wouldn’t happen to them.
At PDQ, we work with businesses of all sizes to assess their security posture, identify gaps, and put the right protections in place – before they’re needed. From cyber security audits and risk assessments to ongoing monitoring and incident response planning, we’re here to help you stay ahead of the threat.
Get in touch with the PDQ team today to arrange a free cyber security consultation. Let’s make sure your business is ready for whatever 2026 brings.
Frequently Asked Questions
How has the UK cyber threat level changed in 2026?
The threat level has increased significantly. The NCSC recorded 204 nationally significant incidents in 2024/25, a 130% rise from the previous year. In January 2026, the NCSC issued fresh warnings about Russian hacktivist groups targeting UK organisations, and in February 2026 warned critical infrastructure operators to prepare for severe cyber attacks.
What is the Cyber Security and Resilience Bill?
This new legislation, expected to become law in 2026, will expand the sectors covered by cyber security regulations, introduce mandatory 24-hour incident reporting, include ransomware attacks as reportable incidents, and increase penalties to up to £17m or 4% of global turnover. It will also bring managed service providers and data centres into scope for the first time.
What were the biggest UK cyber attacks of 2025?
The most notable incidents included a coordinated ransomware campaign against major UK retailers in spring 2025, with an estimated combined cost of £270m–£440m. One retailer alone expected a £300m hit to operating profit. Later in the year, a major UK manufacturer suffered what has been described as the most economically damaging cyber incident in UK history, with costs expected to reach £1.9 billion.
Are small businesses at risk?
Absolutely. 43% of all UK businesses reported a breach or attack in the past year. Small and medium-sized businesses are frequently targeted because they tend to have fewer resources dedicated to security. Cybercriminals are largely sector-agnostic – they look for the easiest way in, regardless of company size.
What is the single most effective thing I can do today?
Enable multi-factor authentication (MFA) on all accounts with access to sensitive systems or data. This single step blocks the majority of unauthorised access attempts, even when passwords have been compromised. It takes minutes to set up but could save your business.
How can PDQ help?
PDQ provides cybersecurity audits, risk assessments, staff training, 24/7 monitoring, incident response planning, and ongoing managed security services. We work with businesses of all sizes across Essex, London, and beyond. Get in touch for a free consultation.
Verified Sources:
All sources below have been verified as live and accessible as of 12 February 2026.
1. UK Cyber Security Breaches Survey 2025
Publisher: Department for Science, Innovation and Technology / Home Office
URL: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025
Data used: 43% of UK businesses experienced a breach/attack; 70% of medium and 74% of large businesses affected; average of 30 cyber crimes per business per year
2. NCSC Annual Review 2025
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025
Data used: 204 nationally significant incidents (130% increase); 18 highly significant incidents (50% increase); ransomware as most acute threat; AI-powered attacks growing
3. NCSC Annual Review 2025 – Chapter 1: Countering the Cyber Threat
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk
Data used: State-backed threats from China, Russia, Iran, North Korea; retail sector attacks (M&S, Co-op); critical national infrastructure risks
4. NCSC Warning: Hacktivist Groups Disrupting UK Organisations (January 2026)
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/news/ncsc-issues-warning-over-hacktivist-groups-disrupting-uk-organisations-online-services
Data used: Russian-aligned hacktivist groups targeting UK local government and critical national infrastructure with denial-of-service attacks
5. NCSC Guidance: Actions to Take When the Cyber Threat Is Heightened
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/guidance/actions-to-take-when-the-cyber-threat-is-heightened
Data used: Specific guidance for organisations during heightened threat periods (referenced for the security checklist)
6. NCSC Guidance: Preparing for Severe Cyber Threats (February 2026)
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/collection/how-to-prepare-and-plan-your-organisations-response-to-severe-cyber-threat-a-guide-for-cni
Data used: Guidance for CNI operators on preparing for deliberate and highly disruptive cyber attacks
7. UK Business Leaders Rank Cyber Breaches as a Top 2026 Risk
Publisher: Nardello & Co (reported by Digit News, 19 January 2026)
URL: https://www.digit.fyi/uk-business-leaders-rank-cyber-breaches-as-a-top-2026-risk/
Data used: 58% of UK business leaders rank cyber breaches as a top risk; 75% doubt their firm’s ability to manage threats; 20% experienced a breach in the past two years
8. Cyber Monitoring Centre Statement on Ransomware Incidents in the Retail Sector (June 2025)
Publisher: Cyber Monitoring Centre
URL: https://cybermonitoringcentre.com/2025/06/20/cyber-monitoring-centre-statement-on-ransomware-incidents-in-the-retail-sector-june-2025/
Data used: M&S and Co-op attacks categorised as Category 2 systemic event; estimated financial impact £270m–£440m; M&S online sales losses of £1.3m per day
9. Cyber Security and Resilience (Network and Information Systems) Bill 2024–26
Publisher: UK Parliament
URL: https://bills.parliament.uk/bills/4035
Data used: Second reading 6 January 2026; Committee Stage reporting by 5 March 2026; expected to become law in 2026
10. NCSC 10 Steps to Cyber Security
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/collection/10-steps
Data used: Free guidance framework (referenced as free resource)
11. NCSC Early Warning Service
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/information/early-warning-service
Data used: Free threat alerting service used by 8,500+ UK organisations
12. NCSC Exercise in a Box
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/information/exercise-in-a-box
Data used: Free scenario-based incident response rehearsal tool
13. Cyber Essentials Certification
Publisher: National Cyber Security Centre
URL: https://www.ncsc.gov.uk/cyberessentials/overview
Data used: Government-backed baseline security certification; free cyber insurance for certified organisations under £20m turnover
14. Action Fraud
Publisher: National Fraud Intelligence Bureau / City of London Police
URL: https://www.actionfraud.police.uk/
Data used: Official UK channel for reporting cyber crime