Cyber attack UK: how small firms get hit and your first 48 hours

The typical cyber attack UK businesses face is not a dramatic hack. It is a convincing email, a fake help desk call or a supplier breach. In the government's latest survey, 43% of UK businesses reported a breach or attack in a year, and if personal data is involved you may have 72 hours to tell the ICO.

The headlines are about Marks & Spencer and Jaguar Land Rover. The lessons are for everyone else: how recent attacks worked, what the numbers say about firms your size, which reporting rules apply, and what to do in the first 48 hours.

The short version

• Most cyber attacks on UK businesses are phishing, which hit 38% of firms in the government's 2025/2026 survey, while ransomware hit just 1%.
• Recent big UK attacks, from M&S to the Department for Education, got in through help desks, suppliers and shared systems rather than clever code.
• A reportable personal data breach must go to the ICO within 72 hours of discovery, and the NCSC report does not count as that legal report.
• In the first hours, put one person in charge, start a log and disconnect affected devices rather than switching them off.
• Only 25% of UK businesses have a formal incident response plan and only 5% hold Cyber Essentials, which starts at £320 plus VAT.

What is a cyber attack, and which types hit UK firms most?

A cyber attack is any deliberate attempt to get into, disrupt, damage or steal from your computers, accounts or data. For small and mid-sized UK firms, most are phishing: fake messages designed to trick someone into handing over a password, a payment or access.

The Cyber Security Breaches Survey 2025/2026, published by the government in April 2026, puts the main types in perspective.

At a glance: the main types of cyber attack

• Phishing (fake emails, texts or calls): hit 38% of UK businesses, and 69% of those attacked called it their most disruptive incident.
• Impersonation (someone pretending to be you, a colleague or a supplier, often to redirect a payment): 12% of businesses.
• Ransomware (software that locks your files until you pay): 1% of businesses, down from 3% the year before. Rare, but the most damaging when it lands.
• Data breach (data seen, copied or leaked by someone who should not have it): the type that brings legal reporting duties.
• DDoS, or denial of service (flooding a website with traffic until it falls over): can take an online shop offline.

Which recent cyber attacks in the UK matter to smaller firms?

The recent UK cyber attacks that matter most to smaller firms are the ones where attackers got in through people, suppliers or shared systems, because those routes exist in every business.

• Marks & Spencer, Easter 2025 (29 to 31 March). A ransomware attack forced M&S to take its website and apps offline, with the cost estimated at over £300 million. Attackers reportedly phoned an outsourced IT helpdesk, pretended to be an employee and talked their way into a login reset.
• Co-op, 7 May 2025. The Co-op took parts of its IT offline after suspicious activity and told staff to verify everyone in remote meetings.
• Jaguar Land Rover. Production stopped for five weeks, with an estimated £1.9 billion hit to the UK economy according to the Cyber Monitoring Centre and more than 5,000 organisations affected across its supply chain without being attacked themselves.
• Three London councils, November 2025. Westminster, Kensington & Chelsea, and Hammersmith & Fulham were hit through shared IT infrastructure; by January 2026 Kensington & Chelsea had written to hundreds of thousands of households.
• Companies House, March 2026. A flaw found on 13 March 2026 left directors' personal data across 5 million registered businesses visible to anyone with a login. If you are a company director, your details may have been among them.
• Department for Education, July 2026. Around 607,000 records were taken through the department's customer help desk and a funding portal, using social engineering (manipulating a person) rather than a technical exploit.

The pattern: nobody broke the encryption. Someone was persuaded, a supplier was compromised or a shared system spread the damage. The national picture is getting heavier too: the NCSC handled 204 nationally significant incidents in the year to August 2025, up from 89 the year before.

How many UK businesses are hit by cyber attacks, and what does it cost?

Around 612,000 UK businesses, 43% of the total, reported a cyber breach or attack in the past 12 months, according to the 2025/2026 survey. Medium firms (65%) were hit far more often than micro (42%) and small (46%) ones.

The surprise is the cost. The median cost of a business's most disruptive incident was £0. The danger sits in the tail: the worst 5% of cases cost micro and small firms £4,000 or more, and medium and large firms £10,000 or more. Where cyber-enabled fraud cost money, the worst 10% lost £15,000 or more.

The gaps are where the risk lives:

• Only 25% of businesses have a formal incident response plan (21% of micro businesses).
• Only 47% use two-factor authentication, a second check such as a code on your phone when logging in.
• Only 15% review the cyber risks posed by their immediate suppliers.
• 22% did not know whether they had any cyber insurance at all.

The government's answer for smaller firms is Cyber Essentials, a certification built on five basic controls, from £320 plus VAT, with a free 30-minute consultation for SMEs. Only 5% of businesses hold it, rising to 12% of small businesses.

Do I have to report a cyber attack in the UK?

You do not have to report every cyber attack, but you must report a personal data breach to the Information Commissioner's Office (ICO) within 72 hours of discovering it if it meets the legal threshold. Reporting to the police and the National Cyber Security Centre (NCSC) is voluntary but worth doing.

Two details trip people up. The ICO clock starts when you discover the breach, not when it happened. And the NCSC is not a regulator: it will not pass your details on without your consent. Unsure whether a breach is reportable? The ICO's advice line is 0303 123 1113. Its guidance is under review following the Data (Use and Access) Act, so check the page first.

What should I do in the first 48 hours after a cyber attack?

In the first 48 hours, contain the damage, write everything down, get expert help and work out whether personal data is involved. This checklist draws on the NCSC's July 2026 guide, What to do when cyber attacks disrupt your organisation, and the ICO's 72-hour advice.

Hour 0 to 2

1. Put one person in charge. The NCSC says the chief executive normally leads. In a small firm, that is you.
2. Start a log. Note what was found, when, and every decision and who made it. Regulators and insurers may ask for it.
3. Disconnect, do not switch off. Taking affected devices off the network limits spread and preserves evidence; shutting them down can destroy it.
4. If the attack is still happening, call Report Fraud on 0300 123 2040.
5. Change passwords on email and key accounts, starting with anything that controls money.

Hour 2 to 24

6. Call your insurer and your IT provider. For serious incidents, the NCSC recommends an NCSC-assured cyber incident response firm.
7. Check your backups before restoring anything. The NCSC warns that rushing recovery before you understand the attack increases the risk.
8. Tell staff, key customers and suppliers through one controlled channel, so nobody improvises.

Hour 24 to 48

9. Decide whether personal data was exposed. If yes, report to the ICO before the 72 hours run out, even with incomplete facts. You can add more later.
10. Watch for the second wave. Treat any "new bank details" request with suspicion and confirm it by phone.
11. Do not pay a ransom in a panic. The NCSC says organisations often have more recovery options than they first realise.

Make the boring list before you need it

The damage lands hardest on businesses with no plan, no second login check and no idea which suppliers can reach their data. A one-page plan, two-factor authentication and Cyber Essentials cost far less than one bad week. To see what an attacker would see, start with what a website security checker misses, or use Swarm Labs' Barb for authorised security testing of the websites and connected tools you depend on.

Want a second pair of eyes on your systems before someone less friendly looks? Talk to the Swarm Labs team.

Sources

1. GOV.UK (DSIT and Home Office): Cyber security breaches survey 2025/2026
2. ICO: 72 hours, how to respond to a personal data breach
3. NCSC: What to do when cyber attacks disrupt your organisation (July 2026)
4. NCSC: Annual Review 2025, incident management
5. NCSC: Cyber Essentials overview
6. Report Fraud: Guide to reporting cyber crime and fraud
7. CyberLab: What the M&S, Co-op and Harrods cyber attacks reveal about modern threats
8. One Compliance: 5 cyber security risks for UK businesses in 2026
9. One Compliance: Major UK cyber attacks and data breaches in 2026