The latest UK Government Cyber Security Breaches Survey shows that cyber risk remains a serious issue for businesses, charities and organisations of all sizes. Although many attacks are unsuccessful, the figures make it clear that cyber security should no longer be seen as a problem only for large companies or technology firms.
For small and medium-sized businesses, the risks can be especially difficult to manage. Many rely heavily on email, websites, online banking, cloud software, card payments, booking systems, customer databases and digital records, but may not have dedicated cyber security staff in place. That can make prevention, response and recovery harder when something goes wrong.
At West Craven Insurance, we believe businesses should treat cyber security as part of their wider risk management. Practical security controls, staff awareness, clear procedures and suitable insurance can all help reduce the impact of a cyber incident.
What Does the Latest Cyber Security Breaches Survey Show?
The Cyber Security Breaches Survey 2025/2026 found that just over four in ten UK businesses experienced some form of cyber security breach or attack in the previous 12 months. Around three in ten charities also reported a breach or attack. These figures only include incidents that organisations were able to identify and were willing to report, so the real level of cyber activity may be higher.
The survey also found that medium and large businesses were more likely to report breaches or attacks than smaller businesses. This does not necessarily mean smaller businesses are safe. In some cases, smaller organisations may have less monitoring in place, making it harder to identify attempted attacks or suspicious account activity.
Phishing remains the most common form of cyber attack by a significant margin. This means criminals are still relying heavily on deceptive emails, fake login pages, malicious links, impersonation and social engineering. These attacks often target people rather than technology, which is why staff awareness remains so important.
Why Phishing Is Still Such a Common Threat
Phishing attacks work because they are designed to look normal. A message may appear to come from a supplier, customer, bank, courier, software provider, colleague or senior manager. It may ask the recipient to log in, check an invoice, open an attachment, approve a payment or update account details.
For a busy business, these messages can be easy to miss. Staff may be dealing with customers, deadlines, orders, payments or urgent enquiries. If a fraudulent email arrives at the right time and looks convincing, one click can be enough to expose login details or allow a criminal to access an account.
Phishing can lead to several different problems, including hacked email accounts, invoice redirection fraud, stolen passwords, malware infections, data exposure and fraudulent payment requests. In many cases, the first sign of a problem is not the original phishing email but the consequences that follow it.
What Types of Cyber Incidents Affect Businesses?
Cyber incidents can take many forms. Some are obvious, such as a locked computer, ransomware message or fraudulent payment request. Others are harder to spot, especially where criminals gain access to an email account and quietly monitor conversations before taking action.
Common cyber incidents include:
- Phishing emails and fake login pages
- Hacked email accounts
- Invoice redirection fraud
- Malware and ransomware attacks
- Impersonation of staff, suppliers or directors
- Unauthorised access to cloud software
- Loss or exposure of customer data
- Compromised payment systems
- Attacks on websites or online booking systems
- Supplier or supply chain cyber incidents
Even a relatively small incident can cause disruption. A hacked email account may stop staff working properly, expose customer information, damage trust and create uncertainty about what has been accessed. A fraudulent invoice email can lead to financial loss. A ransomware attack can prevent access to files, systems and records needed to run the business.
The Business Impact of a Cyber Breach
The financial cost of a cyber breach is only one part of the problem. Cyber incidents can also take up management time, disrupt trading, affect customer communication and create legal or regulatory concerns. Businesses may need to investigate what happened, recover systems, contact customers, check payments, restore files and put additional security measures in place.
For businesses that rely on digital systems, disruption can be immediate. An online retailer may lose orders. A professional firm may lose access to client files. A hospitality business may struggle with bookings or payments. A contractor may be unable to access job records, schedules or supplier information. A shop may lose access to stock systems or card payment records.
Reputation can also be affected. Customers expect businesses to protect their information and communicate clearly if something goes wrong. A slow or confused response can create further damage, especially if customers receive fraudulent emails that appear to come from the business.
Why Cyber Security Is a Board and Management Issue
Cyber security should not be treated as only an IT issue. It affects finance, operations, customer service, HR, compliance, marketing and business continuity. Senior management should understand the risks and make sure someone is responsible for cyber security decisions.
A business does not need to be large to take sensible action. Even basic measures can make a significant difference. Strong passwords, multi-factor authentication, staff training, secure backups, software updates and clear payment verification procedures can all reduce risk.
Businesses should also think about cyber security when buying software, using external providers, storing customer data and giving staff access to systems. If a supplier handles important data or provides business-critical services, their cyber security can affect your business too.
Practical Steps Businesses Can Take
Improving cyber security does not always mean large investment or complex systems. For many small and medium-sized businesses, the first priority should be getting the basics right and making sure staff know what to do when something looks suspicious.
- Use strong, unique passwords for every important account
- Turn on multi-factor authentication wherever possible
- Train staff to recognise phishing emails and fake login pages
- Keep software, devices and browsers updated
- Back up important data regularly and test those backups
- Use antivirus and security tools on business devices
- Check email forwarding rules and account permissions
- Remove access for former staff promptly
- Use a clear process for verifying changes to bank details
- Create a simple cyber incident response plan
One of the most useful controls is a payment verification process. If a supplier sends new bank details by email, confirm the request using a trusted phone number already known to the business. Do not rely on the phone number or contact details included in the email requesting the change.
Why Backups Matter
Backups are one of the most important parts of cyber resilience. If files are deleted, encrypted, corrupted or lost, a good backup can help the business recover faster. However, backups need to be secure, regular and tested. A backup that has never been checked may not work when it is needed.
Businesses should consider what data is essential for trading. This may include accounts, customer records, booking systems, contracts, employee information, website files, order history and important documents. If that information was unavailable for several days, the business could face serious disruption.
Backups should not be connected to the same system in a way that allows ransomware to encrypt them as well. Where possible, businesses should keep separate, secure backups and make sure someone is responsible for checking they are working.
Cyber Insurance and Business Protection
Cyber insurance can help businesses respond to certain types of cyber incident, depending on the cover arranged and the policy terms. It may provide access to specialist incident response support, legal advice, recovery assistance, notification support, cyber crime protection or business interruption cover.
This can be particularly useful because cyber incidents often require quick decisions. A business may need to secure systems, investigate what happened, recover data, communicate with customers, manage financial loss and deal with legal or regulatory issues. Having access to specialist support can help make the response more organised.
Cyber insurance is not a replacement for good security. Insurers may expect businesses to have basic controls in place, such as strong passwords, multi-factor authentication, secure backups and appropriate procedures. The strongest approach is to combine practical cyber security with suitable insurance protection.
Do Small Businesses Need Cyber Insurance?
Small businesses can still be affected by cyber crime. In fact, they may be more vulnerable in some situations because they often have fewer internal resources, less formal IT support and more reliance on a small number of key systems. A single hacked email account or fraudulent payment request can cause a serious problem.
Cyber insurance may be worth considering if your business uses email, holds customer data, takes online payments, uses cloud software, stores business records digitally, depends on a website, or would struggle to trade if systems were unavailable.
The right cover depends on how the business operates. A retailer, accountant, contractor, hospitality business, charity, professional firm or online business may all have different cyber risks. This is why it is important to discuss your activities rather than assuming a standard policy will be suitable.
What Should a Cyber Incident Response Plan Include?
A cyber incident response plan does not need to be complicated. It should explain what staff should do if they suspect an attack, who needs to be informed, how accounts should be secured, how customers are contacted and how the business checks whether money or data has been affected.
A simple plan may include:
- Who is responsible for cyber incident decisions
- Who can reset passwords and secure accounts
- Which IT provider or support contact should be called
- How to check whether payments have been affected
- How to contact customers, suppliers or staff if needed
- Where backups are stored and how they are restored
- Which insurer or broker should be contacted
- How the incident should be recorded internally
When something goes wrong, people can panic or act quickly without checking the facts. A written response plan gives staff a clearer process to follow and can reduce the chance of further mistakes.
Reviewing Cyber Risk in 2026
The latest Cyber Security Breaches Survey shows that cyber risk remains a live issue for UK businesses. Phishing, impersonation, account compromise, data exposure and fraud continue to affect organisations across many sectors.
Businesses should review their cyber protection regularly, especially if they have changed systems, taken on staff, moved more work online, started using cloud software, introduced remote working, added online payments or increased the amount of customer data they hold.
Cyber security is not just about preventing every possible attack. It is about reducing the likelihood of an incident, limiting the damage if one occurs and recovering as quickly as possible.
Speak to West Craven Insurance About Cyber Insurance
If you are unsure whether your business has suitable cyber protection, West Craven Insurance can help you review your options. We can discuss how your business operates, what systems you rely on, what data you hold and what kind of disruption would cause the biggest problem.
Whether cyber cover is arranged as part of a wider business insurance package or as a specific cyber insurance policy, it is important to understand what is included, what is excluded and what conditions apply. Reviewing this before an incident happens is far better than discovering a gap in cover after a claim.
FAQs About the Cyber Security Breaches Survey and Cyber Insurance
What is the Cyber Security Breaches Survey?
The Cyber Security Breaches Survey is an annual UK Government survey that looks at cyber security breaches, attacks, risk management and cyber preparedness among businesses, charities and educational institutions.
It helps show how common cyber attacks are, what types of incidents organisations are experiencing and how businesses are responding to cyber risk.
What is the most common cyber attack affecting businesses?
Phishing remains the most common cyber attack affecting UK businesses. These attacks often use fake emails, malicious links, fraudulent login pages or messages that appear to come from trusted contacts.
Phishing is effective because it targets people as well as systems. Staff training, multi-factor authentication and clear verification procedures can help reduce the risk.
Does business insurance automatically include cyber cover?
Not always. Some business insurance policies may include limited cyber protection, but others may not. Even where some cover is included, it may not provide the same level of support as a dedicated cyber insurance policy.
Businesses should check their policy wording carefully and speak to their broker if they are unsure. It is important to understand whether cyber crime, data breaches, business interruption and incident response support are included.
Can cyber insurance help after a phishing attack?
Cyber insurance may help after a phishing attack, depending on the policy terms and what happened. Some policies may provide support for incident response, legal advice, data recovery, cyber crime losses or business interruption.
The exact cover can vary, so businesses should review the policy before an incident occurs. It is also important to follow security conditions, such as using multi-factor authentication where required.
How often should a business review cyber insurance?
A business should review cyber insurance at least annually and whenever there are major changes. This may include new software, more staff, remote working, online payments, new websites, increased customer data or changes to suppliers.
Cyber risk changes quickly. A policy that was suitable a few years ago may no longer reflect the way the business operates today.
Is your business protected? Get in touch for a no-obligation quote.
