Nearly half of UK small businesses were breached or attacked in the last twelve months. Almost none of it was sophisticated, and the gap that decides how badly it goes is not a technical one.
Nearly half, in a single year
The government’s Cyber Security Breaches Survey for 2025/26 puts it plainly. 46% of small businesses and 42% of micro businesses identified a breach or attack in the previous twelve months. Across all business sizes that is 43%, or roughly 612,000 organisations.
Size is not protection, but it does change the odds: 65% of medium businesses and 69% of large ones were hit. The bigger you are, the more surface you present. The smaller you are, the less you have ready when something lands.
It is phishing. It is almost always phishing.
38% of businesses identified phishing. Impersonation came second at 12%. Ransomware was 1%, down from 3% the year before.
That last number deserves a moment, because it is the one the market gets backwards. Ransomware is what gets written about, budgeted for and sold against. It is not what is happening to you. What is happening to you is a convincing email, and a member of staff with no obvious reason to doubt it.
The preparation gap
This is where the numbers stop being interesting and start being uncomfortable.
Only 21% of micro businesses have a formal incident response plan. Among medium businesses it is 57%, and among large ones 76%. So the organisations least able to absorb a bad week are the least likely to have decided, in advance, who does what during one.
Board-level responsibility follows the same line: 29% of micro and 37% of small businesses have someone at board or owner level explicitly accountable for cyber security, against 68% of large businesses.
And one figure is moving the wrong way. Small businesses carrying out cyber risk assessments fell to 41%, from 48% the year before. While the conversation moved on to AI, the basic exercise of writing down what could go wrong went backwards.
What a small business should take from this
Not that you need a security team. Most organisations this size will never have one, and pretending otherwise is how people end up buying tools they cannot run.
Three things are worth more than any product you could buy this month:
Decide who decides. Before an incident, not during. One named person who can say the word, and one named deputy for when that person is on a plane.
Write down what you would do in the first hour. Not a policy. One page. Who you ring, what you switch off, what you must not delete.
Assume the email is convincing. Train the confirmation habit rather than the suspicion habit — check an unusual request through a channel the sender did not choose.
None of that costs anything. The first-hour checklist, the self-assessment and the awareness posters on this site are free, and none of them require you to talk to us.
Sources
Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/2026, published 30 April 2026. Figures quoted are for UK businesses and are as reported in that publication.